Document the Permissions settings tab (#931)

* Add new permissions page and fix zero trust doc

* Remove API mention

src/components/NavigationDocs.jsx

@@ -408,6 +408,10 @@ export const docsNavigation = [
                         title: 'Multi-Factor Authentication',
                         href: '/manage/settings/multi-factor-authentication',
                     },
+                    {
+                        title: 'Permissions',
+                        href: '/manage/settings/permissions',
+                    },
                     { title: 'IPv6 Overlay Addressing', href: '/manage/settings/ipv6' },
                     { title: 'Auto Update', href: '/manage/peers/auto-update' },
                     { title: 'Lazy Connections', href: '/manage/peers/lazy-connection' },

src/pages/manage/settings/permissions.mdx

@@ -0,0 +1,57 @@
+export const description = 'Control how much of the NetBird dashboard regular users and billing admins can see, including whether they can view peers.'
+
+# Permissions
+
+The `Permissions` tab in your account settings controls how much of the dashboard non-administrative users can see. It currently holds a single setting, `Restrict dashboard for regular users`.
+
+To find it, log in to your NetBird dashboard and navigate to `Settings` > `Permissions`.
+
+<p>
+    <img src="/docs-static/img/manage/settings/permissions-restrict-dashboard.png" alt="Restrict dashboard for regular users setting in the Permissions tab" className="imagewrapper-big"/>
+</p>
+
+## Restrict dashboard for regular users
+
+When this setting is enabled, affected users get a reduced dashboard and cannot view any peers, including the peers they own themselves.
+
+<Note>
+    This setting is **enabled by default** on new accounts. If you want regular users to be able to see their own peers, you need to turn it off explicitly.
+</Note>
+
+### Who it applies to
+
+The restriction applies to users with the following roles:
+
+- `User` (regular users)
+- `Billing Admin`
+
+Owners and administrators are never affected, and neither are service users acting through an access token with the appropriate permissions.
+
+<Note>
+    Despite the name, the setting also restricts billing admins. If you have billing admins who need to see peers, this setting has to be off.
+</Note>
+
+### What changes when it is enabled
+
+Affected users keep their network access. The restriction is about visibility in the dashboard, not connectivity. Their peers stay connected and policies continue to apply as normal.
+
+In the dashboard, those users see the following:
+
+- The `Peers` page shows a blocked view instead of the peers table
+- Peer and group detail pages are not reachable and redirect back
+- Group and country data is not loaded
+- Parts of the navigation and account menu are hidden
+
+Through the API, peer listing endpoints return an empty list for those users rather than an error.
+
+### What changes when it is disabled
+
+Turning the setting off does not give regular users visibility of the whole network. They see only the peers they own, which is the standard behavior for the `User` role. Administrators continue to see all peers in the account either way.
+
+## Changing the setting
+
+1. Go to `Settings` > `Permissions`.
+2. Toggle `Restrict dashboard for regular users` on or off.
+3. Click `Save Changes`.
+
+You need permission to update account settings to change this, which in practice means an owner or administrator.

src/pages/use-cases/security/implement-zero-trust.mdx

@@ -938,7 +938,7 @@ Where to configure: **Settings → Permissions** in the NetBird dashboard.
 
 - **Restrict dashboard for regular users**
 
-    Limit dashboard access to administrators only, preventing regular users from viewing or modifying network configurations, policies, and peer information. This follows the principle of least privilege and reduces the risk of accidental or malicious configuration changes.
+    Prevent users with the `User` and `Billing Admin` roles from viewing any peers in the dashboard, including the peers they own themselves. Without it, those users can still see their own peers. This limits how much of your network inventory is visible to non-administrators. Note that it is enabled by default on new accounts, and that it affects visibility only, not connectivity or the ability to change configuration, which is already governed by roles. See [Permissions](/manage/settings/permissions) for details.
 
 ---