anchor.diff:  settings update, rerouting, or managing users and roles.
   
   `monitor`::
  -All cluster read-only operations, like cluster health & state, hot threads, node
  -info, node & cluster stats, snapshot/restore status, pending cluster tasks.
  +All cluster read-only operations, like cluster health and state, hot threads, 
  +node info, node and cluster stats, and pending cluster tasks.
   
   `monitor_ml`::
   All read only {ml} operations, such as getting information about {dfeeds}, jobs,
  
positive.code: 
  `manage`::
  Builds on `monitor` and adds cluster operations that change values in the cluster.
  This includes snapshotting, updating settings, and rerouting. This privilege does
  not include the ability to manage security.
  
  `manage_index_templates`::
  All operations on index templates.
  
negative.code: Any action on an index
  
  `monitor`::
  All actions that are required for monitoring (recovery, segments info, index 
  stats and status).
  
  `manage`::
  All `monitor` privileges plus index administration (aliases, analyze, cache clear,
  