anchor.diff:  build] permission should also be granted with caution as a vulnerability in the Docker build 
   logic could result in a privileges being granted on the host node.
   
  -By default, project administrators (the
  -link:../architecture/additional_concepts/authorization.html#roles[*admin* role])
  -and project editors (the
  -link:../architecture/additional_concepts/authorization.html#roles[*edit* role])
  -are granted permission to use all build strategies (Docker, Source-to-Image, and
  -Custom).
  +By default, all users that can create builds are granted permission to use all 
  +build strategies (Docker, Source-to-Image, and Custom).
   
   You can control who can build with what build strategy using an
   link:../architecture/additional_concepts/authorization.html[authorization
  -policy]. Each build strategy has a corresponding build subresource. Granting
  -permission to *create* on the build subresource allows the user to create builds
  -of that type.
  +policy]. Each build strategy has a corresponding build subresource.
  +A user must have permission to create a build _and_ permission to create 
  +on the build strategy subresource in order to create builds using that strategy.
  +Default roles are provided which grant the *create* permission on the build strategy subresource.
   
  -.Build Strategy Subresources
  -[cols="1,1",options="header"]
  +.Build Strategy Subresources and Roles
  +[options="header"]
   |===
   
  -|Strategy |Subresource
  +|Strategy |Subresource |Role
   
   |Docker
   |builds/docker
  +|system:build-strategy-docker
   
   |Source-to-Image
   |builds/source
  +|system:build-strategy-source
   
   |Custom
   |builds/custom
  +|system:build-strategy-custom
   
   |===
   
   == Disabling a Build Strategy Globally
   To prevent access to a particular build strategy globally, log in as a user with
   link:../architecture/additional_concepts/authorization.html#roles[*cluster-admin*]
  -privileges and edit each of the default roles:
  +privileges and remove the corresponding role from the *system:authenticated* group:
  +
  +----
  +$ oadm policy remove-cluster-role-from-group system:build-strategy-custom system:authenticated
  +$ oadm policy remove-cluster-role-from-group system:build-strategy-docker system:authenticated
  +$ oadm policy remove-cluster-role-from-group system:build-strategy-source system:authenticated
  +----
  +
  +ifdef::openshift-origin[]
  +In versions prior to 1.2, the build strategy subresources were included in the `admin` and `edit` roles.
  +endif::[]
  +ifdef::openshift-enterprise[]
  +In versions prior to 3.2, the build strategy subresources were included in the `admin` and `edit` roles.
  +endif::[]
  +Ensure the build strategy subresources are also removed from these roles:
   
   ----
   $ oc edit clusterrole admin
   $ oc edit clusterrole edit
   ----
  -
  -For each role, remove the line that corresponds to the resource of the strategy to disable:
  + 
  +For each role, remove the line that corresponds to the resource of the strategy to disable.
   
   .Disable the Docker Build Strategy for *admin*
   =====
  
positive.code: set of specific users within a project to create builds with a particular
  strategy:
  
  . link:#disabling-a-build-strategy-globally[Remove the build strategy resource
  from the default *admin* and *edit* roles].
  . link:#create-separate-role[Create a separate role for that build strategy.]
  . Assign the role to a specific user within a project. For example, to add the
  new *dockerbuilder* role within the project *devproject* to the user *devuser*:
  +
  ====
  
  ----
  $ oadm policy add-role-to-user dockerbuilder devuser -n devproject
  ----
  ====
  
negative.code: metadata:
    name: admin
  ...
  rules:
  - resources:
    - builds/custom
    - builds/docker <1>
    - builds/source
    ...
  ...
  ----
  <1> Delete this line to disable Docker builds globally for users with the *admin* role.
  =====
  
  [[restricting-build-strategies-to-a-user-globally]]
  
  == Restricting Build Strategies to a User Globally
  
  To allow only a set of specific users to create builds with a particular strategy:
  
  . link:#disabling-a-build-strategy-globally[Disable global access to the build strategy].
  
  . Assign the role corresponding to the build strategy to a specific user.
  For example, to add the *system:build-strategy-docker* cluster role to the user *devuser*:
  +
  ====
  ----
  $ oadm policy add-cluster-role-to-user system:build-strategy-docker devuser
  ----
  ====
  
  