docs: Add Roles and permissions page for team accounts (DOCS-481)

accounts-billing/manage-accounts.mdx

@@ -1,4 +1,4 @@
 ---
 title: "Manage accounts"
 description: "Create accounts, manage teams, and configure user permissions in Runpod. Review account, billing, and management details for Runpod."
 ---
@@ -9,7 +9,7 @@
 
 Sign up for a Runpod account at [console.runpod.io/signup](https://www.console.runpod.io/signup).
 
 Once created, you can use your account to deploy Pods, create Serverless endpoints, and access other Runpod services. Personal accounts can be converted to team accounts at any time to enable collaboration features.
 
 ## Convert to a team account
 
@@ -29,19 +29,11 @@
 
 ## Invite team members
 
-Team accounts can invite new members to collaborate. Each invitation includes a specific role that determines the member's permissions.
+Team accounts can invite new members to collaborate, and each invitation includes a specific role that determines the member's permissions.
 
 <img src="https://promptless-customer-doc-assets.s3.amazonaws.com/docs-images/org_2tHD09rTU0IcE4clVjTuJCTn0an/create-team-invite-dialog-d8cb3fc6.png" alt="Create Team Invite dialog showing role selection and required email field" />
 
-To invite a new member:
-
-1. Navigate to the [Team page](https://www.console.runpod.io/team) in the Runpod console.
-2. In the **Members** section, select **Invite New Member**.
-3. Choose [the appropriate role](#roles-and-permissions) for the new member.
-4. Enter the email address of the person you want to invite and click **Create Invite**.
-5. Copy the generated invitation link from the **Pending Invites** section and share it with the person you want to invite.
-
-Invitation links remain active until used or manually revoked. You can view all pending invitations in the team management interface.
+For step-by-step instructions on inviting a member and choosing their role, see [Assign a role to a team member](/accounts-billing/roles-and-permissions#assign-a-role-to-a-team-member).
 
 ## Join a team
 
@@ -50,52 +42,17 @@
 1. Click the invitation link provided by the team member.
 2. Select **Join Team** to accept the invitation.
 
-Your account will gain access to the team's resources based on the role assigned to you.
+Your account will gain access to the team's resources based on the role assigned to you. To see what your assigned role allows, see [Roles and permissions](/accounts-billing/roles-and-permissions).
 
 ## Roles and permissions
 
-Runpod provides four distinct roles to control access within team accounts. Each role includes specific permissions designed for different responsibilities.
-
-| Permission | Basic | Billing | Dev | Admin |
-|------------|-------|---------|-----|-------|
-| Access team account | ✅ | ✅ | ✅ | ✅ |
-| Connect to existing Pods | ✅ | ❌ | ✅ | ✅ |
-| Create/delete/start/stop Pods | ❌ | ❌ | ✅ | ✅ |
-| Create/delete Serverless endpoints | ❌ | ❌ | ✅ | ✅ |
-| Send requests to Serverless endpoints | ✅ | ❌ | ✅ | ✅ |
-| Connect to existing Instant Clusters | ✅ | ❌ | ✅ | ✅ |
-| Create/delete/start/stop Instant Clusters | ❌ | ❌ | ❌ | ✅ |
-| Create/update/delete network volumes | ❌ | ❌ | ✅ | ✅ |
-| View billing information | ❌ | ✅ | ❌ | ✅ |
-| Manage payment methods | ❌ | ✅ | ❌ | ✅ |
-| Invite team members | ❌ | ❌ | ❌ | ✅ |
-| Manage team permissions | ❌ | ❌ | ❌ | ✅ |
-| Modify team account settings | ❌ | ❌ | ❌ | ✅ |
-| Access audit logs | ❌ | ❌ | ❌ | ✅ |
-
-### Basic role
-
-The basic role provides essential access for users who need to work with existing resources without management capabilities.
-
-This role allows users to access the team account and connect to already-deployed computing resources (e.g., Pods and Serverless endpoints) for development work. Users with this role cannot view billing information, start or stop Pods, or create new resources.
-
-### Billing role
+Runpod team accounts provide four built-in roles (Basic, Billing, Dev, and Admin) that control access to Pods, Serverless endpoints, network volumes, and billing. Each role grants a different set of permissions.
 
-The billing role focuses exclusively on financial management aspects of the account.
+For the full permissions matrix and guidance on assigning and revoking roles, see [Roles and permissions](/accounts-billing/roles-and-permissions).
 
-Users with this role can access all billing information, manage payment methods, and view invoices. They cannot access computing resources, making this role ideal for finance team members who need billing access without operational permissions.
-
-### Dev role
-
-The dev role extends basic permissions with additional capabilities for active development work.
-
-This role includes all basic permissions plus the ability to start, stop, and create Pods. Developers can fully manage computing resources for their work while remaining restricted from billing information and account settings.
-
-### Admin role
-
-The admin role provides complete control over all account features and settings.
-
-Administrators have unrestricted access to manage team members, configure account settings, handle billing, and control all team computing resources. This role should be reserved for team leaders and trusted members who need full account access.
+<Tip>
+Apply the principle of least privilege by assigning each member the minimum role necessary for their work.
+</Tip>
 
 ## Account spend limits
 
@@ -113,9 +70,7 @@
 
 ## Best practices
 
-When managing team accounts, establish clear role assignments based on each member's responsibilities. Regularly review team membership and remove access for members who no longer need it.
-
-For enhanced security, use the principle of least privilege by assigning the minimum role necessary for each team member's work. Consider creating separate accounts for billing management to isolate financial access from technical operations.
+When managing team accounts, regularly review team membership and remove access for members who no longer need it.
 
 Monitor audit logs periodically to ensure compliance with your organization's policies and identify any unauthorized activities early.
 

accounts-billing/roles-and-permissions.mdx

@@ -0,0 +1,107 @@
+---
+title: "Roles and permissions"
+sidebarTitle: "Roles and permissions"
+description: "Understand Runpod's built-in team roles and use them to control what team members can do with Pods, Serverless endpoints, network volumes, and billing."
+---
+
+Runpod team accounts use built-in roles to control what each member can access and do. Assigning roles lets an admin delegate work without granting full account control. This page is for admins who manage a team account. To create or convert a team and invite members, see [Manage accounts](/accounts-billing/manage-accounts). If you received an invitation and want to join, see [Join a team](/accounts-billing/manage-accounts#join-a-team).
+
+## Why use roles
+
+Roles let you apply least privilege by granting each member the minimum role they need for their work. Use the Billing role to separate billing access from technical operations, so finance staff can manage payment methods and invoices without touching compute resources. Use the Dev role to let developers create and manage compute without exposing billing or account settings. Reserve the Admin role for trusted leads who need full control over members, settings, billing, and all compute.
+
+## Available roles
+
+### Basic role
+
+The Basic role provides essential access for users who need to work with existing resources without management capabilities. It allows users to access the team account and connect to already-deployed resources such as [Pods](/pods/overview), [Serverless endpoints](/serverless/overview), and [Instant Clusters](/instant-clusters). Users with this role cannot view billing information, start or stop Pods, or create new resources.
+
+### Billing role
+
+The Billing role focuses exclusively on financial management. Users with this role can access billing information, manage payment methods, and view invoices, but they cannot access compute resources. This makes the role ideal for finance staff who need billing access without operational permissions.
+
+### Dev role
+
+The Dev role extends the Basic permissions with additional capabilities for active development work. It includes all Basic permissions plus the ability to create, start, and stop Pods and manage [network volumes](/storage/network-volumes). Instant Cluster management (creating, deleting, starting, and stopping Instant Clusters) is reserved for the Admin role. Users with this role remain restricted from billing information and account settings.
+
+### Admin role
+
+The Admin role provides full control over the account. Administrators can manage team members, configure account settings, handle billing, and control all compute resources. Reserve this role for trusted leads who need full account access.
+
+## Permissions matrix
+
+The following matrix shows which permissions each role grants:
+
+| Permission | Basic | Billing | Dev | Admin |
+|------------|-------|---------|-----|-------|
+| Access team account | ✅ | ✅ | ✅ | ✅ |
+| Connect to existing Pods | ✅ | ❌ | ✅ | ✅ |
+| Create/delete/start/stop Pods | ❌ | ❌ | ✅ | ✅ |
+| Create/delete Serverless endpoints | ❌ | ❌ | ✅ | ✅ |
+| Send requests to Serverless endpoints | ✅ | ❌ | ✅ | ✅ |
+| Connect to existing Instant Clusters | ✅ | ❌ | ✅ | ✅ |
+| Create/delete/start/stop Instant Clusters | ❌ | ❌ | ❌ | ✅ |
+| Create/update/delete network volumes | ❌ | ❌ | ✅ | ✅ |
+| View billing information | ❌ | ✅ | ❌ | ✅ |
+| Manage payment methods | ❌ | ✅ | ❌ | ✅ |
+| Invite team members | ❌ | ❌ | ❌ | ✅ |
+| Manage team permissions | ❌ | ❌ | ❌ | ✅ |
+| Modify team account settings | ❌ | ❌ | ❌ | ✅ |
+| Access audit logs | ❌ | ❌ | ❌ | ✅ |
+
+If your assigned role does not grant access you need, contact your team's Admin to request a different role.
+
+## Assign a role to a team member
+
+You assign a role when you invite a member to your team. The role you choose at invite time determines the member's permissions.
+
+<Steps>
+  <Step title="Open the Team page">
+    Navigate to the [Team page](https://www.console.runpod.io/team) in the Runpod console.
+  </Step>
+  <Step title="Start a new invite">
+    In the **Members** section, select **Invite New Member**.
+  </Step>
+  <Step title="Choose the role">
+    Choose the appropriate role for the new member. This role determines what the member can access and do.
+  </Step>
+  <Step title="Enter the member's email">
+    Enter the email address of the person you want to invite and select **Create Invite**.
+  </Step>
+  <Step title="Share the invitation link">
+    Copy the generated invitation link from the **Pending Invites** section and share it with the person you want to invite.
+  </Step>
+</Steps>
+
+<Note>
+Invitation links remain active until used or manually revoked.
+</Note>
+
+## Remove access
+
+You can revoke a pending invitation from the **Pending Invites** section before it is used. As part of general offboarding, review team membership regularly and revoke access that is no longer needed.
+
+To dissolve an entire team and revert to a personal account, see [Manage accounts](/accounts-billing/manage-accounts#convert-to-a-team-account).
+
+## Best practices
+
+Assign roles based on each member's responsibilities, and apply the principle of least privilege by granting the minimum role necessary for each person's work. Isolate billing access from technical operations by using the Billing role for finance staff.
+
+Review team membership regularly and remove access for members who no longer need it. Review audit logs periodically to ensure compliance with your organization's policies and to identify unusual activity early.
+
+## Next steps
+
+<CardGroup cols={2}>
+  <Card title="Manage accounts" href="/accounts-billing/manage-accounts" icon="users" horizontal>
+    Create or convert a team and invite members.
+  </Card>
+  <Card title="Billing" href="/accounts-billing/billing" icon="credit-card" horizontal>
+    Set up billing and payment methods.
+  </Card>
+  <Card title="Monitor account activity" href="/accounts-billing/manage-accounts#monitor-account-activity" icon="list-check" horizontal>
+    Review audit logs to track actions across your team.
+  </Card>
+  <Card title="Cost centers" href="/accounts-billing/cost-centers" icon="chart-pie" horizontal>
+    Attribute team spend by project or team.
+  </Card>
+</CardGroup>

docs.json

@@ -279,6 +279,7 @@
             "group": "Accounts and billing",
             "pages": [
               "accounts-billing/manage-accounts",
+              "accounts-billing/roles-and-permissions",
               "accounts-billing/billing",
               "accounts-billing/cost-centers",
               "accounts-billing/referrals",