Docs: reformat merger and executor config docs
Change-Id: I75e67a592cdef5fcf4a2576cd5a5814cb79211f8
diff --git a/doc/source/glossary.rst b/doc/source/glossary.rst
index 98bee10..6c8a4b4 100644
--- a/doc/source/glossary.rst
+++ b/doc/source/glossary.rst
@@ -45,6 +45,27 @@
might leave feedback in a remote system on a proposed change,
send email, or store information in a database.
+ trusted execution context
+
+ Playbooks defined in a :term:`config-project` run in the
+ *trusted* execution context. The trusted execution context has
+ access to all Ansible features, including the ability to load
+ custom Ansible modules.
+
+ untrusted execution context
+
+ Playbooks defined in an :term:`untrusted-project` run in the
+ *untrusted* execution context. Playbooks run in the untrusted
+ execution context are not permitted to load additional Ansible
+ modules or access files outside of the restricted environment
+ prepared for them by the executor. In addition to the
+ bubblewrap environment applied to both execution contexts, in
+ the untrusted context some standard Ansible modules are replaced
+ with versions which prohibit some actions, including attempts to
+ access files outside of the restricted execution context. These
+ redundant protections are made as part of a defense-in-depth
+ strategy.
+
untrusted-project
One of two types of projects which may be specified by the