docs: Update Infracost Cloud roles description (#621)

infracost · Apr 1, 2024 · 1bdf59d · 1bdf59d
1 parent 5e03c6d
commit 1bdf59d
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/docs/infracost_cloud/key_concepts.md b/docs/infracost_cloud/key_concepts.md
@@ -41,10 +41,11 @@ Infracost API keys are associated with organizations and can be retrieved from t
 
 ### Team management
 
-From the Members page, you can invite your team members to join your organization. Currently three roles are supported:
-- Org Owner: they own and have complete control over the organization. We currently treat the Org Owner as the main billing contact for the organization too. From the Members page, you can change the Org Owner to another member.
-- Org Admin: they can do everything in the organization except deleting the organization..
-- Org Viewer: they can view everything in the organization except the API key. They cannot make any changes.
+From the Members page, you can invite your team members to join your organization. Currently these roles are supported:
+- Org Owner: they have complete control over the organization. From the Members page, the owner can make another member the owner instead. We recommend giving the main billing contact the owner role. Only the owner can delete the organization or change its name or slug.
+- Org Admin: they can do everything in the organization except deleting it, or changing its name or slug. We recommend giving FinOps/Platform team members the admin role so they can setup the Infracost integrations for everyone and manage custom price books etc.
+- Org Editor: they can change everything except things in the Org Settings area and data exports. This means they cannot invite members to the organization either. We recommend giving team leads/managers the editor role so they can also add guardrails, policies and reports for their teams if required.
+- Org Viewer: they can view everything in the organization except things in the Org Settings area. They cannot make any changes apart from their personal user settings such as their password or multi-factor-authentication setup. We recommend giving engineers the viewer role so they can see preexisting issues and fix them.
 
 ## Repos