diff --git a/src/pages/agent-network/index.mdx b/src/pages/agent-network/index.mdx
index 9438bbbb..20994db7 100644
--- a/src/pages/agent-network/index.mdx
+++ b/src/pages/agent-network/index.mdx
@@ -90,9 +90,9 @@ For API-managed accounts, `agent_network_only` requires `dashboard_features.agen
 Managing Agent Network does not require full account admin rights. Two dedicated roles delegate access:
 
 - **Agent Network Admin** fully manages providers, policies, guardrails, budgets, usage, access logs, and Agent Network settings, with read-only visibility into peers and team members (needed to build policies) and no access to the rest of the account.
-- **Usage Viewer** sees the usage and cost overview only - for finance and team leads tracking LLM spend.
+- **Usage Viewer** sees the usage and cost overview, with read-only access to the resources its filters resolve against (users, groups, peers, the provider list) - for finance and team leads tracking LLM spend.
 
-Every user, with any role, can read their own consumption and the connection details their policies allow (endpoint, providers, models) through the self-service API (`/api/agent-network/me/setup` and `/api/agent-network/me/consumption`). See [User Roles](/manage/team/user-roles) for the full permission matrix.
+Every user, with any role, can read the connection details their policies allow (endpoint, providers, models) through the self-service API (`/api/agent-network/me/setup`), and their own usage and requests through the regular usage and access-log endpoints, which answer with the caller's own data when the role has no account-wide access. See [User Roles](/manage/team/user-roles) for the full permission matrix.
 
 ## Next steps
 
diff --git a/src/pages/manage/team/user-roles.mdx b/src/pages/manage/team/user-roles.mdx
index 6f4803d0..3885fd61 100644
--- a/src/pages/manage/team/user-roles.mdx
+++ b/src/pages/manage/team/user-roles.mdx
@@ -16,9 +16,9 @@ Rows are grouped by what a `Network Admin` can do, from full access down to no a
 | Access Control | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | 📖 | ❌ |
 | Network Routing | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | 📖 | ❌ |
 | DNS | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | 📖 | ❌ |
-| Peers | ✅ | ✅ | 📖 | 📖 | ❌ | 📖<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>1</sup> | 📖 | 📖<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>1</sup> |
+| Peers | ✅ | ✅ | 📖 | 📖 | ❌ | 📖 | 📖 | 📖<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>1</sup> |
 | Setup Keys | ✅ | ✅ | 📖 | ❌ | ❌ | ❌ | 📖 | ❌ |
-| Team | ✅ | ✅ | 📖 | 📖 | ❌ | ❌ | 📖 | ❌ |
+| Team | ✅ | ✅ | 📖 | 📖 | ❌ | 📖 | 📖 | ❌ |
 | Activity | ✅ | ✅ | 📖 | ❌ | ❌ | ❌ | 📖 | ❌ |
 | Settings | ✅ | ✅ | 📖 | ❌ | ✅<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>2</sup> | ❌ | 📖 | ❌ |
 | Agent Network | ✅ | ✅ | ❌ | ✅ | ❌ | 📖<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>3</sup> | 📖 | ❌<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>4</sup> |
@@ -32,9 +32,9 @@ Rows are grouped by what a `Network Admin` can do, from full access down to no a
 
 <sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>2</sup> A `Billing Admin`'s Settings access is limited to **Plans & Billing** and **Invoices**.
 
-<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>3</sup> A `Usage Viewer`'s Agent Network access is limited to the aggregated usage and cost overview.
+<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>3</sup> A `Usage Viewer`'s Agent Network access is limited to the aggregated usage and cost overview and a read-only view of the provider list (the provider and model filter options).
 
-<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>4</sup> Every user, regardless of role, can see their own Agent Network usage and the connection details their access policies allow (endpoint, providers, models) through the self-service API.
+<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>4</sup> Every user, regardless of role, can see their own Agent Network usage and requests, and the connection details their access policies allow (endpoint, providers, models) - the usage and log APIs answer with the caller's own data when the role has no account-wide access.
 
 ## Owner
 The `Owner` has full access to the account and can manage every aspect of it. There can be only one account owner in NetBird. Owners are the only users who can delete the organization account - see [Delete NetBird account](/manage/settings/delete-account) for more.
@@ -49,7 +49,7 @@ A `Network Admin` fully manages network configuration - Control Center, Access C
 An `Agent Network Admin` fully manages [Agent Network](/agent-network) - LLM providers, access policies, guardrails, budgets, usage, access logs, and its settings. They have read-only access to Peers and Team, needed to build access policies, and no access to anything else in the account: no network configuration, no setup keys, no billing.
 
 ## Usage Viewer
-A `Usage Viewer` sees the [Agent Network](/agent-network) usage and cost overview, with per-user and per-group breakdowns, and nothing more. The role is meant for cost stakeholders - finance, team leads, project owners - who track LLM spend without administering anything. A `Usage Viewer` sees no provider configuration, no access policies, and no request-level access logs (which can contain captured prompts).
+A `Usage Viewer` sees the [Agent Network](/agent-network) usage and cost overview, with per-user and per-group breakdowns, and nothing more. The role is meant for cost stakeholders - finance, team leads, project owners - who track LLM spend without administering anything. To make the usage filters and breakdowns work, the role carries read-only access to users, groups, peers, and the provider list. A `Usage Viewer` can't change any of those, sees no provider credentials or access policies, and no request-level access logs (which can contain captured prompts).
 
 ## Billing Admin
 A `Billing Admin` manages billing only. They can access `Settings` → `Plans & Billing` and `Settings` → `Invoices`, and have no access to any other part of the account.
@@ -58,7 +58,7 @@ A `Billing Admin` manages billing only. They can access `Settings` → `Plans &
 An `Auditor` can read every configuration in the account but can't modify anything.
 
 ## User
-A `User` has limited access: they can view the peers they own and other peers they're allowed to connect to. Every user can also read their own Agent Network usage and the connection details their access policies allow via the self-service API endpoints (`GET /api/agent-network/me/setup` and `GET /api/agent-network/me/consumption`) - no role change or admin involvement needed.
+A `User` has limited access: they can view the peers they own and other peers they're allowed to connect to. Every user can also read the Agent Network connection details their access policies allow via the self-service endpoint (`GET /api/agent-network/me/setup`) and their own usage and requests through the regular usage and access-log endpoints, which answer with the caller's own data when the role has no account-wide access - no role change or admin involvement needed.
 
 ## Roles and the API
 Roles apply the same way whether a user works in the dashboard or through the [NetBird management API](/api) - a user's permissions over API resources match their role. Every role except `User` can create a personal access token that carries the same permissions as that user's role, so they can interact with the API programmatically.