fix role access descriptions in authorization documentation

Author: timdeschryver

aspnetcore/security/authorization/roles.md

@@ -59,8 +59,8 @@ Access to an action can be limited by applying additional role authorization att
 
 In the preceding `ControlAllPanelController` controller:
 
-* Members of the `Administrator` role or the `PowerUser` role can access the controller and the `ShutDown` action.
-* Only members of the `Administrator` role can access the `SetTime` action.
+* Members of the `Administrator` role or the `PowerUser` role can access the controller and the `SetTime` action.
+* Only members of the `Administrator` role can access the `ShutDown` action.
 
 A controller can be secured but allow anonymous, unauthenticated access to individual actions:
 
@@ -138,8 +138,8 @@ If multiple attributes are applied at the controller and action levels, ***all**
 
 In the preceding `ControlAllPanelController` controller:
 
-* Members of the `Administrator` role or the `PowerUser` role can access the controller and the `SetTime` action.
-* Only members of the `Administrator` role can access the `ShutDown` action.
+* Members of the `Administrator` role can access the controller and the `SetTime` action.
+* Only members of the `Administrator` **and** the `PowerUser` role can access the `ShutDown` action.
 
 You can also lock down a controller but allow anonymous, unauthenticated access to individual actions.