Document Metrics Read-Only role permissions

docs/cloud/get-started/api-keys.mdx

@@ -425,8 +425,9 @@ Temporal API keys automatically expire based on the specified expiration time. [
 
 :::tip
 
-Service Accounts can rotate their own API keys irrespective of their configured permissions. To use this feature, have
-your Service Account create a new API key using the [Cloud Ops APIs](/ops) or the CLI before the current
+Service Accounts can create replacement API keys for themselves regardless of their configured permissions, except for
+Service Accounts with the [Metrics Read-Only role](/cloud/metrics/openmetrics#metrics-read-only-role). To use this
+feature, have your Service Account create a new API key using the [Cloud Ops APIs](/ops) or the CLI before the current
 one expires. Service Accounts cannot delete their own API keys without the requisite permissions, which helps keep
 Workflow access secure.
 

docs/cloud/manage-access/permissions-reference.mdx

@@ -24,9 +24,13 @@ supports the following account-level roles:
 - Developer
 - Finance Admin
 - Read-Only
+- Metrics Read-Only
 
 ### Cloud Ops API permissions
 
+The Metrics Read-Only role grants no Cloud Ops API permissions, so it is not included in the following table. For its
+permissions and API key requirements, see [Metrics Read-Only role](/cloud/metrics/openmetrics#metrics-read-only-role).
+
 This table provides API-level details for permissions granted through account-level roles. These permissions are
 configured per user.
 

docs/cloud/manage-access/roles-and-permissions.mdx

@@ -25,13 +25,18 @@ such as:
 The following table provides a summary of the account-level roles and their primary purpose. Refer to the
 [Permissions reference](/cloud/manage-access/permissions-reference#account-level-access) for API-level details.
 
-| Role          | Primary purpose                             | Can create Namespaces | Automatic Namespace Admin               | Billing and usage access          |
-| ------------- | ------------------------------------------- | --------------------- | --------------------------------------- | --------------------------------- |
-| Account Owner | Owns and governs the account                | Yes                   | All Namespaces (cannot be revoked)      | Full billing, payments, and usage |
-| Global Admin  | Administers account configuration and users | Yes                   | All Namespaces (cannot be revoked)      | Usage only                        |
-| Developer     | Creates and manages Namespaces they own     | Yes                   | Namespaces they create (can be revoked) | None                              |
-| Finance Admin | Manages billing and payment information     | No                    | None                                    | Full billing, payments, and usage         |
-| Read-Only     | Views account configuration and resources   | No                    | None                                    | None                              |
+| Role              | Primary purpose                                | Can create Namespaces | Automatic Namespace Admin               | Billing and usage access          |
+| ----------------- | ---------------------------------------------- | --------------------- | --------------------------------------- | --------------------------------- |
+| Account Owner     | Owns and governs the account                   | Yes                   | All Namespaces (cannot be revoked)      | Full billing, payments, and usage |
+| Global Admin      | Administers account configuration and users    | Yes                   | All Namespaces (cannot be revoked)      | Usage only                        |
+| Developer         | Creates and manages Namespaces they own        | Yes                   | Namespaces they create (can be revoked) | None                              |
+| Finance Admin     | Manages billing and payment information        | No                    | None                                    | Full billing, payments, and usage |
+| Read-Only         | Views account configuration and resources      | No                    | None                                    | None                              |
+| Metrics Read-Only | Reads account metrics from the OpenMetrics API | No                    | None                                    | None                              |
+
+The Metrics Read-Only role is intended for Service Accounts used by observability integrations. It grants read access to
+the [Temporal Cloud OpenMetrics endpoint](/cloud/metrics/openmetrics) but no other permissions. An Account Owner or
+Global Admin must manage the Service Account and its API keys.
 
 Account-level roles don't govern day-to-day operations within a Namespace. Access to resources inside a Namespace, such
 as Workflows and Workflow Executions, is controlled by [Namespace-level permissions](#namespace-level-permissions).

docs/cloud/manage-access/service-accounts.mdx

@@ -44,6 +44,9 @@ Account Owner and Global Admin [roles](/cloud/manage-access/users#account-level-
 
 Account Owner and Global Admin [roles](/cloud/manage-access/users#account-level-roles) also have the ability to manage API Keys for Service Accounts.
 
+For permissions and API key requirements for Metrics Read-Only Service Accounts, see
+[Metrics Read-Only role](/cloud/metrics/openmetrics#metrics-read-only-role).
+
 ### Prerequisites
 
 - A Cloud user account with Account Owner or Global Admin [role](/cloud/manage-access/users#account-level-roles) permissions

docs/cloud/metrics/openmetrics/index.mdx

@@ -20,13 +20,21 @@ Future pricing may apply to high-volume usage that exceeds standard [limits](/cl
 
 Temporal Cloud's [OpenMetrics](https://openmetrics.io/) endpoint provides operational metrics for your Temporal Cloud workloads in industry-standard Prometheus format, enabling comprehensive monitoring across Namespaces, Workflows, and Task Queues with your existing observability stack.
 
+## Metrics Read-Only role {/* #metrics-read-only-role */}
+
+Metrics Read-Only is an account-level role intended for Service Accounts that scrape the OpenMetrics endpoint. It grants
+read access to the OpenMetrics endpoint but no other permissions.
+
+An Account Owner or Global Admin must create and manage the Service Account and all of its API keys. A Metrics Read-Only
+Service Account cannot create, update, or delete API keys, including its own.
+
 ## Quickstart
 
 Stream metrics from Temporal Cloud into your observability tool in about 5 minutes.
 
 **Prerequisites**
 
-- An **Account Owner** or **Global Admin** role on the Temporal Cloud account. The Metrics Read-Only role is an account-level role and can only be granted by these roles. A Namespace Admin cannot complete these steps.
+- An **Account Owner** or **Global Admin** role on the Temporal Cloud account. The [Metrics Read-Only role](#metrics-read-only-role) can only be granted by these roles. A Namespace Admin cannot complete these steps.
 - An account in the observability tool you want to use, such as Datadog, Grafana Cloud, New Relic, ClickStack, or self-hosted Prometheus.
 
 **Steps**