From 2dde8b8a104fa459974ef902d7061ce2b583adc9 Mon Sep 17 00:00:00 2001 From: mlsmaycon Date: Tue, 18 Aug 2026 17:21:32 +0000 Subject: [PATCH] Update Agent Network self-service and usage_viewer docs The dedicated me/consumption endpoint is gone: every user's own usage and requests come through the regular usage and access-log endpoints, which answer with the caller's own data when the role has no account-wide access. usage_viewer now carries read-only access to the resources the usage filters resolve against (users, groups, peers, provider list). --- src/pages/agent-network/index.mdx | 4 ++-- src/pages/manage/team/user-roles.mdx | 12 ++++++------ 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/src/pages/agent-network/index.mdx b/src/pages/agent-network/index.mdx index 9438bbbb..20994db7 100644 --- a/src/pages/agent-network/index.mdx +++ b/src/pages/agent-network/index.mdx @@ -90,9 +90,9 @@ For API-managed accounts, `agent_network_only` requires `dashboard_features.agen Managing Agent Network does not require full account admin rights. Two dedicated roles delegate access: - **Agent Network Admin** fully manages providers, policies, guardrails, budgets, usage, access logs, and Agent Network settings, with read-only visibility into peers and team members (needed to build policies) and no access to the rest of the account. -- **Usage Viewer** sees the usage and cost overview only - for finance and team leads tracking LLM spend. +- **Usage Viewer** sees the usage and cost overview, with read-only access to the resources its filters resolve against (users, groups, peers, the provider list) - for finance and team leads tracking LLM spend. -Every user, with any role, can read their own consumption and the connection details their policies allow (endpoint, providers, models) through the self-service API (`/api/agent-network/me/setup` and `/api/agent-network/me/consumption`). See [User Roles](/manage/team/user-roles) for the full permission matrix. +Every user, with any role, can read the connection details their policies allow (endpoint, providers, models) through the self-service API (`/api/agent-network/me/setup`), and their own usage and requests through the regular usage and access-log endpoints, which answer with the caller's own data when the role has no account-wide access. See [User Roles](/manage/team/user-roles) for the full permission matrix. ## Next steps diff --git a/src/pages/manage/team/user-roles.mdx b/src/pages/manage/team/user-roles.mdx index 6f4803d0..3885fd61 100644 --- a/src/pages/manage/team/user-roles.mdx +++ b/src/pages/manage/team/user-roles.mdx @@ -16,9 +16,9 @@ Rows are grouped by what a `Network Admin` can do, from full access down to no a | Access Control | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | 📖 | ❌ | | Network Routing | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | 📖 | ❌ | | DNS | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | 📖 | ❌ | -| Peers | ✅ | ✅ | 📖 | 📖 | ❌ | 📖1 | 📖 | 📖1 | +| Peers | ✅ | ✅ | 📖 | 📖 | ❌ | 📖 | 📖 | 📖1 | | Setup Keys | ✅ | ✅ | 📖 | ❌ | ❌ | ❌ | 📖 | ❌ | -| Team | ✅ | ✅ | 📖 | 📖 | ❌ | ❌ | 📖 | ❌ | +| Team | ✅ | ✅ | 📖 | 📖 | ❌ | 📖 | 📖 | ❌ | | Activity | ✅ | ✅ | 📖 | ❌ | ❌ | ❌ | 📖 | ❌ | | Settings | ✅ | ✅ | 📖 | ❌ | ✅2 | ❌ | 📖 | ❌ | | Agent Network | ✅ | ✅ | ❌ | ✅ | ❌ | 📖3 | 📖 | ❌4 | @@ -32,9 +32,9 @@ Rows are grouped by what a `Network Admin` can do, from full access down to no a 2 A `Billing Admin`'s Settings access is limited to **Plans & Billing** and **Invoices**. -3 A `Usage Viewer`'s Agent Network access is limited to the aggregated usage and cost overview. +3 A `Usage Viewer`'s Agent Network access is limited to the aggregated usage and cost overview and a read-only view of the provider list (the provider and model filter options). -4 Every user, regardless of role, can see their own Agent Network usage and the connection details their access policies allow (endpoint, providers, models) through the self-service API. +4 Every user, regardless of role, can see their own Agent Network usage and requests, and the connection details their access policies allow (endpoint, providers, models) - the usage and log APIs answer with the caller's own data when the role has no account-wide access. ## Owner The `Owner` has full access to the account and can manage every aspect of it. There can be only one account owner in NetBird. Owners are the only users who can delete the organization account - see [Delete NetBird account](/manage/settings/delete-account) for more. @@ -49,7 +49,7 @@ A `Network Admin` fully manages network configuration - Control Center, Access C An `Agent Network Admin` fully manages [Agent Network](/agent-network) - LLM providers, access policies, guardrails, budgets, usage, access logs, and its settings. They have read-only access to Peers and Team, needed to build access policies, and no access to anything else in the account: no network configuration, no setup keys, no billing. ## Usage Viewer -A `Usage Viewer` sees the [Agent Network](/agent-network) usage and cost overview, with per-user and per-group breakdowns, and nothing more. The role is meant for cost stakeholders - finance, team leads, project owners - who track LLM spend without administering anything. A `Usage Viewer` sees no provider configuration, no access policies, and no request-level access logs (which can contain captured prompts). +A `Usage Viewer` sees the [Agent Network](/agent-network) usage and cost overview, with per-user and per-group breakdowns, and nothing more. The role is meant for cost stakeholders - finance, team leads, project owners - who track LLM spend without administering anything. To make the usage filters and breakdowns work, the role carries read-only access to users, groups, peers, and the provider list. A `Usage Viewer` can't change any of those, sees no provider credentials or access policies, and no request-level access logs (which can contain captured prompts). ## Billing Admin A `Billing Admin` manages billing only. They can access `Settings` → `Plans & Billing` and `Settings` → `Invoices`, and have no access to any other part of the account. @@ -58,7 +58,7 @@ A `Billing Admin` manages billing only. They can access `Settings` → `Plans & An `Auditor` can read every configuration in the account but can't modify anything. ## User -A `User` has limited access: they can view the peers they own and other peers they're allowed to connect to. Every user can also read their own Agent Network usage and the connection details their access policies allow via the self-service API endpoints (`GET /api/agent-network/me/setup` and `GET /api/agent-network/me/consumption`) - no role change or admin involvement needed. +A `User` has limited access: they can view the peers they own and other peers they're allowed to connect to. Every user can also read the Agent Network connection details their access policies allow via the self-service endpoint (`GET /api/agent-network/me/setup`) and their own usage and requests through the regular usage and access-log endpoints, which answer with the caller's own data when the role has no account-wide access - no role change or admin involvement needed. ## Roles and the API Roles apply the same way whether a user works in the dashboard or through the [NetBird management API](/api) - a user's permissions over API resources match their role. Every role except `User` can create a personal access token that carries the same permissions as that user's role, so they can interact with the API programmatically.