Document Agent Network Admin and Usage Viewer roles

Add the two delegated Agent Network roles to the user-roles matrix and
role descriptions, note the self-service endpoints every user can read,
and add an access-roles section to the Agent Network overview.

src/pages/agent-network/index.mdx

@@ -85,6 +85,15 @@ To use the full NetBird platform, open **Settings** and turn off **Agent Network
 
 For API-managed accounts, `agent_network_only` requires `dashboard_features.agent_network` to be enabled. See the [Accounts API reference](/ipa/resources/accounts) for the account settings schema.
 
+## Access Roles
+
+Managing Agent Network does not require full account admin rights. Two dedicated roles delegate access:
+
+- **Agent Network Admin** fully manages providers, policies, guardrails, budgets, usage, access logs, and Agent Network settings, with read-only visibility into peers and team members (needed to build policies) and no access to the rest of the account.
+- **Usage Viewer** sees the usage and cost overview only - for finance and team leads tracking LLM spend.
+
+Every user, with any role, can read their own consumption and the connection details their policies allow (endpoint, providers, models) through the self-service API (`/api/agent-network/me/setup` and `/api/agent-network/me/consumption`). See [User Roles](/manage/team/user-roles) for the full permission matrix.
+
 ## Next steps
 
 - [Quickstart](/agent-network/quickstart). Deploy NetBird Agent Network and make your first routed LLM call.

src/pages/manage/team/user-roles.mdx

@@ -1,29 +1,30 @@
 import {Note} from "@/components/mdx"
 
-export const description = "Understand NetBird's user roles — Owner, Admin, Network Admin, Billing Admin, Auditor, and User — what each can access, and how to assign them."
+export const description = "Understand NetBird's user roles — Owner, Admin, Network Admin, Agent Network Admin, Billing Admin, Usage Viewer, Auditor, and User — what each can access, and how to assign them."
 
 # User Roles
 
-NetBird has six user roles - `Owner`, `Admin`, `Network Admin`, `Billing Admin`, `Auditor`, and `User`. A user's role controls the level of access they have to your account, both in the dashboard and through the management API.
+NetBird has eight user roles - `Owner`, `Admin`, `Network Admin`, `Agent Network Admin`, `Billing Admin`, `Usage Viewer`, `Auditor`, and `User`. A user's role controls the level of access they have to your account, both in the dashboard and through the management API.
 
 ## Permissions at a glance
 
 Rows are grouped by what a `Network Admin` can do, from full access down to no access.
 
-| Area | Owner | Admin | Network Admin | Billing Admin | Auditor | User |
-| --: | :--: | :--: | :--: | :--: | :--: | :--: |
-| Control Center | ✅ | ✅ | ✅ | ❌ | 📖 | ❌ |
-| Access Control | ✅ | ✅ | ✅ | ❌ | 📖 | ❌ |
-| Network Routing | ✅ | ✅ | ✅ | ❌ | 📖 | ❌ |
-| DNS | ✅ | ✅ | ✅ | ❌ | 📖 | ❌ |
-| Peers | ✅ | ✅ | 📖 | ❌ | 📖 | 📖<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>1</sup> |
-| Setup Keys | ✅ | ✅ | 📖 | ❌ | 📖 | ❌ |
-| Team | ✅ | ✅ | 📖 | ❌ | 📖 | ❌ |
-| Activity | ✅ | ✅ | 📖 | ❌ | 📖 | ❌ |
-| Settings | ✅ | ✅ | 📖 | ✅<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>2</sup> | 📖 | ❌ |
-| Reverse Proxy | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ |
-| Tenants | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ |
-| Integrations | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ |
+| Area | Owner | Admin | Network Admin | Agent Network Admin | Billing Admin | Usage Viewer | Auditor | User |
+| --: | :--: | :--: | :--: | :--: | :--: | :--: | :--: | :--: |
+| Control Center | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | 📖 | ❌ |
+| Access Control | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | 📖 | ❌ |
+| Network Routing | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | 📖 | ❌ |
+| DNS | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | 📖 | ❌ |
+| Peers | ✅ | ✅ | 📖 | 📖 | ❌ | 📖<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>1</sup> | 📖 | 📖<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>1</sup> |
+| Setup Keys | ✅ | ✅ | 📖 | ❌ | ❌ | ❌ | 📖 | ❌ |
+| Team | ✅ | ✅ | 📖 | 📖 | ❌ | ❌ | 📖 | ❌ |
+| Activity | ✅ | ✅ | 📖 | ❌ | ❌ | ❌ | 📖 | ❌ |
+| Settings | ✅ | ✅ | 📖 | ❌ | ✅<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>2</sup> | ❌ | 📖 | ❌ |
+| Agent Network | ✅ | ✅ | ❌ | ✅ | ❌ | 📖<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>3</sup> | 📖 | ❌<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>4</sup> |
+| Reverse Proxy | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | 📖 | ❌ |
+| Tenants | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | 📖 | ❌ |
+| Integrations | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | 📖 | ❌ |
 
 **Legend:** ✅ = Full access · 📖 = Read only · ❌ = No access
 
@@ -31,6 +32,10 @@ Rows are grouped by what a `Network Admin` can do, from full access down to no a
 
 <sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>2</sup> A `Billing Admin`'s Settings access is limited to **Plans & Billing** and **Invoices**.
 
+<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>3</sup> A `Usage Viewer`'s Agent Network access is limited to the aggregated usage and cost overview.
+
+<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>4</sup> Every user, regardless of role, can see their own Agent Network usage and the connection details their access policies allow (endpoint, providers, models) through the self-service API.
+
 ## Owner
 The `Owner` has full access to the account and can manage every aspect of it. There can be only one account owner in NetBird. Owners are the only users who can delete the organization account - see [Delete NetBird account](/manage/settings/delete-account) for more.
 
@@ -40,6 +45,12 @@ An `Admin` has full access to the account, with two exceptions: administrators c
 ## Network Admin
 A `Network Admin` fully manages network configuration - Control Center, Access Control, Network Routing, and DNS. They have read-only access to Peers, Setup Keys, Team, Activity, and Settings, and no access to Reverse Proxy, Tenants, or Integrations. A `Network Admin` can view setup keys but not create them, and can't invite users or create service users.
 
+## Agent Network Admin
+An `Agent Network Admin` fully manages [Agent Network](/agent-network) - LLM providers, access policies, guardrails, budgets, usage, access logs, and its settings. They have read-only access to Peers and Team, needed to build access policies, and no access to anything else in the account: no network configuration, no setup keys, no billing.
+
+## Usage Viewer
+A `Usage Viewer` sees the [Agent Network](/agent-network) usage and cost overview, with per-user and per-group breakdowns, and nothing more. The role is meant for cost stakeholders - finance, team leads, project owners - who track LLM spend without administering anything. A `Usage Viewer` sees no provider configuration, no access policies, and no request-level access logs (which can contain captured prompts).
+
 ## Billing Admin
 A `Billing Admin` manages billing only. They can access `Settings` → `Plans & Billing` and `Settings` → `Invoices`, and have no access to any other part of the account.
 
@@ -47,7 +58,7 @@ A `Billing Admin` manages billing only. They can access `Settings` → `Plans &
 An `Auditor` can read every configuration in the account but can't modify anything.
 
 ## User
-A `User` has limited access: they can view the peers they own and other peers they're allowed to connect to.
+A `User` has limited access: they can view the peers they own and other peers they're allowed to connect to. Every user can also read their own Agent Network usage and the connection details their access policies allow via the self-service API endpoints (`GET /api/agent-network/me/setup` and `GET /api/agent-network/me/consumption`) - no role change or admin involvement needed.
 
 ## Roles and the API
 Roles apply the same way whether a user works in the dashboard or through the [NetBird management API](/api) - a user's permissions over API resources match their role. Every role except `User` can create a personal access token that carries the same permissions as that user's role, so they can interact with the API programmatically.