Skip to content

Clarify Finance Admin assignment restrictions #5282

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
LutaoX wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Clarify Finance Admin assignment restrictions #5282

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions docs/cloud/manage-access/roles-and-permissions.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,10 @@ The following table provides a summary of the account-level roles and their prim
| Finance Admin | Manages billing and payment information | No | None | Full billing, payments, and usage |
| Read-Only | Views account configuration and resources | No | None | None |

Account Owner is the only customer role that can assign Finance Admin. This applies to users, groups, and Service
Accounts. Global Admin can create these principals but cannot assign Finance Admin. Global Admin has usage visibility,
not billing or payment access. Finance Admin is not a substitute for Account Owner.

Account-level roles don't govern day-to-day operations within a Namespace. Access to resources inside a Namespace, such
as Workflows and Workflow Executions, is controlled by [Namespace-level permissions](#namespace-level-permissions).

Expand Down
2 changes: 1 addition & 1 deletion docs/cloud/manage-access/users.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ In addition, there are two roles that the Global Admin cannot assign:
- **Finance Admin**
- Has permissions to view [billing](/cloud/billing-and-usage) information and update payment information
- Otherwise, has the same permissions as Account Read-only users
- Can be assigned to Service Accounts by a Global Admin, but otherwise can only be assigned by an Account Owner
- Only an Account Owner can assign Finance Admin to a user, group, or Service Account

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Carry the Finance Admin restriction into role-update guides

When a Global Admin follows the existing task guidance, docs/cloud/manage-access/users.mdx still says they can update any user's account-level role and identifies only Account Owner as restricted (lines 102–103). The equivalent guides in docs/cloud/manage-access/user-groups.mdx (lines 44, 87–93) and docs/cloud/manage-access/service-accounts.mdx (lines 37, 194–213) likewise tell Global Admins to select or change an account role without this exception. Update those three procedural pages so they do not direct Global Admins toward a Finance Admin assignment that the newly documented rule says they cannot perform.

AGENTS.md reference: AGENTS.md:L234-L242

Useful? React with 👍 / 👎.


:::note Default Role

Expand Down