diff --git a/datacenter/ucp/2.2/guides/access-control/grant-permissions.md b/datacenter/ucp/2.2/guides/access-control/grant-permissions.md
index 97632b31e0..22d9db637c 100644
--- a/datacenter/ucp/2.2/guides/access-control/grant-permissions.md
+++ b/datacenter/ucp/2.2/guides/access-control/grant-permissions.md
@@ -7,14 +7,14 @@ keywords: ucp, grant, role, permission, authentication, authorization
If you're a UCP administrator, you can create *grants* to control how users
and organizations access swarm resources.
+{: .with-border}
+
A grant is made up of a *subject*, a *role*, and a *resource collection*.
A grant defines who (subject) has how much access (role)
to a set of resources (collection). Each grant is a 1:1:1 mapping of
subject, role, collection. For example, you can grant the "Prod Team"
"Restricted Control" permissions for the "/Production" collection.
-{: .with-border}
-
The usual workflow for creating grants has four steps.
1. Set up your users and teams. For example, you might want three teams,
@@ -23,6 +23,8 @@ The usual workflow for creating grants has four steps.
3. Optionally, create custom roles for specific permissions to the Docker API.
4. Grant role-based access to collections for your teams.
+{: .with-border}
+
## Create a grant
When you have your users, collections, and roles set up, you can create
diff --git a/datacenter/ucp/2.2/guides/access-control/index.md b/datacenter/ucp/2.2/guides/access-control/index.md
index a0d201b526..91371b98fd 100644
--- a/datacenter/ucp/2.2/guides/access-control/index.md
+++ b/datacenter/ucp/2.2/guides/access-control/index.md
@@ -19,7 +19,7 @@ A grant defines who (subject) has how much access (role)
to a set of resources (collection).
[Learn how to grant permissions to users based on roles](grant-permissions.md).
-
+
An administrator is a user who can manage grants, subjects, roles, and
collections. An administrator identifies which operations can be performed
diff --git a/datacenter/ucp/2.2/guides/access-control/manage-access-with-collections.md b/datacenter/ucp/2.2/guides/access-control/manage-access-with-collections.md
index 747d21d1bf..c34b097c7c 100644
--- a/datacenter/ucp/2.2/guides/access-control/manage-access-with-collections.md
+++ b/datacenter/ucp/2.2/guides/access-control/manage-access-with-collections.md
@@ -8,6 +8,8 @@ Docker EE enables controlling access to container resources by using
*collections*. A collection is a group of swarm resources,
like services, containers, volumes, networks, and secrets.
+{: .with-border}
+
Access to collections goes through a directory structure that arranges a
swarm's resources. To assign permissions, administrators create grants
against directory branches.
diff --git a/datacenter/ucp/2.2/guides/access-control/permission-levels.md b/datacenter/ucp/2.2/guides/access-control/permission-levels.md
index 172657d973..d79eeec03b 100644
--- a/datacenter/ucp/2.2/guides/access-control/permission-levels.md
+++ b/datacenter/ucp/2.2/guides/access-control/permission-levels.md
@@ -11,6 +11,8 @@ regular users have permissions that range from no access to full control over
resources like volumes, networks, images, and containers. Users are
grouped into teams and organizations.
+
+
Administrators create *grants* to users, teams, and organizations to give
permissions to swarm resources.
@@ -39,7 +41,7 @@ The system provides the following default roles:
| `Scheduler` | The user can view nodes and schedule workloads on them. Worker nodes and manager nodes are affected by `Scheduler` grants. Having `Scheduler` access doesn't allow the user to view workloads on these nodes. They need the appropriate resource permissions, like `Container View`. By default, all users get a grant with the `Scheduler` role against the `/Shared` collection. |
| `Full Control` | The user can view and edit volumes, networks, and images, They can create containers without any restriction, but can't see other users' containers. |
-
+
Administrators can create a custom role that has Docker API permissions
that specify the API actions that a subject may perform.
diff --git a/datacenter/ucp/2.2/guides/images/collections-and-resources.svg b/datacenter/ucp/2.2/guides/images/collections-and-resources.svg
new file mode 100644
index 0000000000..9dcb437439
--- /dev/null
+++ b/datacenter/ucp/2.2/guides/images/collections-and-resources.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/datacenter/ucp/2.2/guides/images/isolate-volumes-diagram.svg b/datacenter/ucp/2.2/guides/images/isolate-volumes-diagram.svg
index 27baf62fc8..7912a3d692 100644
--- a/datacenter/ucp/2.2/guides/images/isolate-volumes-diagram.svg
+++ b/datacenter/ucp/2.2/guides/images/isolate-volumes-diagram.svg
@@ -1 +1 @@
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/datacenter/ucp/2.2/guides/images/permissions-ucp.svg b/datacenter/ucp/2.2/guides/images/permissions-ucp.svg
new file mode 100644
index 0000000000..f62646cefd
--- /dev/null
+++ b/datacenter/ucp/2.2/guides/images/permissions-ucp.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/datacenter/ucp/2.2/guides/images/role-diagram.svg b/datacenter/ucp/2.2/guides/images/role-diagram.svg
new file mode 100644
index 0000000000..db18ae4593
--- /dev/null
+++ b/datacenter/ucp/2.2/guides/images/role-diagram.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/datacenter/ucp/2.2/guides/images/roles-and-permission.svg b/datacenter/ucp/2.2/guides/images/roles-and-permission.svg
new file mode 100644
index 0000000000..f62646cefd
--- /dev/null
+++ b/datacenter/ucp/2.2/guides/images/roles-and-permission.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/datacenter/ucp/2.2/guides/images/ucp-grant-model-0.svg b/datacenter/ucp/2.2/guides/images/ucp-grant-model-0.svg
new file mode 100644
index 0000000000..de7c6f16c1
--- /dev/null
+++ b/datacenter/ucp/2.2/guides/images/ucp-grant-model-0.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/datacenter/ucp/2.2/guides/images/ucp-grant-model.svg b/datacenter/ucp/2.2/guides/images/ucp-grant-model.svg
new file mode 100644
index 0000000000..7c586d56ac
--- /dev/null
+++ b/datacenter/ucp/2.2/guides/images/ucp-grant-model.svg
@@ -0,0 +1 @@
+
\ No newline at end of file