anchor.diff:      ;
   
   tlsOption
  -    : SSL
  -    | X509
  -    | CIPHER STRING
  -    | ISSUER STRING
  -    | SUBJECT STRING
  +    : SSL | CIPHER STRING | ISSUER STRING | SUBJECT STRING | ID
       ;
   
   resourceOption
  
positive.code:     ;
  
  role
      : STRING AT_ STRING
      | STRING
      | ID
      ;
  
  roles
  
negative.code:     ;
  
  user
      : STRING AT_ STRING | STRING | ID
      ;
  
  users
  