anchor.diff:  
   == How Do I?
   
  -*Grant Access to the Privileged SCC*
  +=== Grant Access to the Privileged SCC
   
   In some cases, an administrator might want to allow users or groups outside the
   administrator group access to create more privileged pods. To do so, you can:
  
positive.code:   type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  groups:
  - system:serviceaccounts
  
  $ oc create -f scc_admin.json
  securitycontextconstraints/scc-admin
  $ oc get scc
  NAME         PRIV      CAPS      HOSTDIR   SELINUX     RUNASUSER
  
negative.code: Note that a fully-qualified service account user name is in the form of
  *system:serviceaccount:<namesapce>:<name>*.
  
  . Create the registry using `oadm registry --service-account=<name> --mount-host=<dir> ...`
  