From 649492af8a72853178f827b19ade3677e08cba33 Mon Sep 17 00:00:00 2001 From: Lutao Xie Date: Wed, 9 Sep 2026 11:19:59 -0400 Subject: [PATCH 1/2] Clarify Finance Admin assignment restrictions Co-authored-by: Cursor --- docs/cloud/manage-access/roles-and-permissions.mdx | 4 ++++ docs/cloud/manage-access/users.mdx | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/cloud/manage-access/roles-and-permissions.mdx b/docs/cloud/manage-access/roles-and-permissions.mdx index 4831282226..ea2b4ee57d 100644 --- a/docs/cloud/manage-access/roles-and-permissions.mdx +++ b/docs/cloud/manage-access/roles-and-permissions.mdx @@ -33,6 +33,10 @@ The following table provides a summary of the account-level roles and their prim | Finance Admin | Manages billing and payment information | No | None | Full billing, payments, and usage | | Read-Only | Views account configuration and resources | No | None | None | +Account Owner is the only customer role that can assign Finance Admin. This applies to users, groups, and Service +Accounts. Global Admin can create these principals but cannot assign Finance Admin. Global Admin has usage visibility, +not billing or payment access. Finance Admin is not a substitute for Account Owner. + Account-level roles don't govern day-to-day operations within a Namespace. Access to resources inside a Namespace, such as Workflows and Workflow Executions, is controlled by [Namespace-level permissions](#namespace-level-permissions). diff --git a/docs/cloud/manage-access/users.mdx b/docs/cloud/manage-access/users.mdx index fb118a6ba0..f034cc6bfa 100644 --- a/docs/cloud/manage-access/users.mdx +++ b/docs/cloud/manage-access/users.mdx @@ -55,7 +55,7 @@ In addition, there are two roles that the Global Admin cannot assign: - **Finance Admin** - Has permissions to view [billing](/cloud/billing-and-usage) information and update payment information - Otherwise, has the same permissions as Account Read-only users - - Can be assigned to Service Accounts by a Global Admin, but otherwise can only be assigned by an Account Owner + - Only an Account Owner can assign Finance Admin to a user, group, or Service Account :::note Default Role From 24885a59a75857fcda25bf4ef4881f61a3ee055c Mon Sep 17 00:00:00 2001 From: Duncan Mackenzie Date: Fri, 18 Sep 2026 09:58:58 -0700 Subject: [PATCH 2/2] Tighten Finance Admin assignment wording Use "role" instead of the undefined "customer role" to match terminology used elsewhere on the page, and cut a sentence that restated what the rest of the paragraph already said. --- docs/cloud/manage-access/roles-and-permissions.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/cloud/manage-access/roles-and-permissions.mdx b/docs/cloud/manage-access/roles-and-permissions.mdx index ea2b4ee57d..704579165c 100644 --- a/docs/cloud/manage-access/roles-and-permissions.mdx +++ b/docs/cloud/manage-access/roles-and-permissions.mdx @@ -33,9 +33,9 @@ The following table provides a summary of the account-level roles and their prim | Finance Admin | Manages billing and payment information | No | None | Full billing, payments, and usage | | Read-Only | Views account configuration and resources | No | None | None | -Account Owner is the only customer role that can assign Finance Admin. This applies to users, groups, and Service +Account Owner is the only role that can assign Finance Admin. This applies to users, groups, and Service Accounts. Global Admin can create these principals but cannot assign Finance Admin. Global Admin has usage visibility, -not billing or payment access. Finance Admin is not a substitute for Account Owner. +not billing or payment access. Account-level roles don't govern day-to-day operations within a Namespace. Access to resources inside a Namespace, such as Workflows and Workflow Executions, is controlled by [Namespace-level permissions](#namespace-level-permissions).