sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-09-01 20:51:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Scope the Usage Viewer log restriction to account-wide access logs

Browse Source 
The role description denied request-level access logs outright, while the
User section says every user reads their own requests through the
caller-scoped endpoints. Qualify the restriction as account-wide and note
the self-scoped access that remains, matching the backend docs.
This commit is contained in:
mlsmaycon
2026-09-01 12:43:20 +00:00
parent 2dc7c1d39f
commit 70049eee1e
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/pages/manage/team/user-roles.mdx
View File

@@ -49,7 +49,7 @@ A `Network Admin` fully manages network configuration - Control Center, Access C
An `Agent Network Admin` fully manages [Agent Network](/agent-network) - LLM providers, access policies, guardrails, budgets, usage, access logs, and its settings. They have read-only access to Peers and Team, needed to build access policies, and no access to anything else in the account: no network configuration, no setup keys, no billing.
## Usage Viewer
A `Usage Viewer` sees the [Agent Network](/agent-network) usage and cost overview, with per-user and per-group breakdowns, and nothing more. The role is meant for cost stakeholders - finance, team leads, project owners - who track LLM spend without administering anything. To make the usage filters and breakdowns work, the role carries read-only access to users, groups, peers, and the provider list. A `Usage Viewer` can't change any of those, sees no provider credentials or access policies, and no request-level access logs (which can contain captured prompts).
A `Usage Viewer` sees the [Agent Network](/agent-network) usage and cost overview, with per-user and per-group breakdowns, and nothing more. The role is meant for cost stakeholders - finance, team leads, project owners - who track LLM spend without administering anything. To make the usage filters and breakdowns work, the role carries read-only access to users, groups, peers, and the provider list. A `Usage Viewer` can't change any of those, sees no provider credentials or access policies, and no account-wide request-level access logs (which can contain captured prompts). Like every user, they can still read their own requests through the caller-scoped access-log endpoints.
## Billing Admin
A `Billing Admin` manages billing only. They can access `Settings` → `Plans & Billing` and `Settings` → `Invoices`, and have no access to any other part of the account.