anchor.diff:    * used for no authentication option above
   2. keycloak instance with plugins
     * used for enmasse authentication option above
  -  * need to setup keycloak realm per address space with admin user
  +  * need to setup keycloak realm per address space with admin user that can view and edit that realm
   
  -TODO: Need to update the address model to include the necessary
  +[NOTE]
  +Need to update the address model to include the necessary
   configuration details for the authentication service to use in the
  -address space resource schema. This includes host and port, but may
  -also be a CA cert for verifying the authentication services
  -certificate.
  +address space resource schema. This includes host, port and a CA cert
  +for verifying the authentication services certificate.
   
   ....
   diff --git a/documentation/address-model/resource-definitions.md b/documentation/address-model/resource-definitions.md
  
positive.code: 
  == console authorisation
  
  == configuring authentication for an address-space
  
  Three options presented to user:
  
negative.code: == scope
  
  There are various different interfaces for externally facing
  components that need to protected via authentication. There are also
  two types of userbase:
  
  1. there is the userbase for the openshift/kubernetes cluster that is
  controlled by the cluster administrators
  
  2. each address-space will have its own userbase that the owner of
  that address space can control
  
  === address controller api
  
  