Document Agent Network Admin and Usage Viewer roles

src/components/mdx.jsx

@@ -26,6 +26,16 @@ export const h5 = function H5(props) {
   return <Heading level={5} {...props} />
 }
 
+// Wide markdown tables would otherwise paint past the content column and
+// under the sticky "On this page" menu; scroll them within the column instead.
+export const table = function Table(props) {
+  return (
+    <div className="overflow-x-auto">
+      <table {...props} />
+    </div>
+  )
+}
+
 function InfoIcon(props) {
   return (
     <svg viewBox="0 0 16 16" aria-hidden="true" {...props}>

src/pages/agent-network/index.mdx

@@ -85,6 +85,15 @@ To use the full NetBird platform, open **Settings** and turn off **Agent Network
 
 For API-managed accounts, `agent_network_only` requires `dashboard_features.agent_network` to be enabled. See the [Accounts API reference](/ipa/resources/accounts) for the account settings schema.
 
+## Access Roles
+
+Managing Agent Network does not require full account admin rights. Two dedicated roles delegate access:
+
+- **Agent Network Admin** fully manages providers, policies, guardrails, budgets, usage, access logs, and Agent Network settings, with read-only visibility into peers and team members (needed to build policies) and no access to the rest of the account.
+- **Usage Viewer** sees the usage and cost overview, with read-only access to the resources its filters resolve against (users, groups, peers, the provider list) - for finance and team leads tracking LLM spend.
+
+Every user, with any role, can read the connection details their policies allow (endpoint, providers, models) through the self-service API (`/api/agent-network/me/setup`), and their own usage and requests through the regular usage and access-log endpoints, which answer with the caller's own data when the role has no account-wide access. See [User Roles](/manage/team/user-roles) for the full permission matrix.
+
 ## Next steps
 
 - [Quickstart](/agent-network/quickstart). Deploy NetBird Agent Network and make your first routed LLM call.

src/pages/manage/team/user-roles.mdx

@@ -1,36 +1,41 @@
 import {Note} from "@/components/mdx"
 
-export const description = "Understand NetBird's user roles — Owner, Admin, Network Admin, Billing Admin, Auditor, and User — what each can access, and how to assign them."
+export const description = "Understand NetBird's user roles — Owner, Admin, Network Admin, Agent Network Admin, Billing Admin, Usage Viewer, Auditor, and User — what each can access, and how to assign them."
 
 # User Roles
 
-NetBird has six user roles - `Owner`, `Admin`, `Network Admin`, `Billing Admin`, `Auditor`, and `User`. A user's role controls the level of access they have to your account, both in the dashboard and through the management API.
+NetBird has eight user roles - `Owner`, `Admin`, `Network Admin`, `Agent Network Admin`, `Billing Admin`, `Usage Viewer`, `Auditor`, and `User`. A user's role controls the level of access they have to your account, both in the dashboard and through the management API.
 
 ## Permissions at a glance
 
 Rows are grouped by what a `Network Admin` can do, from full access down to no access.
 
-| Area | Owner | Admin | Network Admin | Billing Admin | Auditor | User |
-| --: | :--: | :--: | :--: | :--: | :--: | :--: |
-| Control Center | ✅ | ✅ | ✅ | ❌ | 📖 | ❌ |
-| Access Control | ✅ | ✅ | ✅ | ❌ | 📖 | ❌ |
-| Network Routing | ✅ | ✅ | ✅ | ❌ | 📖 | ❌ |
-| DNS | ✅ | ✅ | ✅ | ❌ | 📖 | ❌ |
-| Peers | ✅ | ✅ | 📖 | ❌ | 📖 | 📖<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>1</sup> |
-| Setup Keys | ✅ | ✅ | 📖 | ❌ | 📖 | ❌ |
-| Team | ✅ | ✅ | 📖 | ❌ | 📖 | ❌ |
-| Activity | ✅ | ✅ | 📖 | ❌ | 📖 | ❌ |
-| Settings | ✅ | ✅ | 📖 | ✅<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>2</sup> | 📖 | ❌ |
-| Reverse Proxy | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ |
-| Tenants | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ |
-| Integrations | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ |
+| Area | Owner | Admin | Network Admin | Agent Network Admin | Billing Admin | Usage Viewer | Auditor | User |
+| --: | :--: | :--: | :--: | :--: | :--: | :--: | :--: | :--: |
+| Control Center | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | 📖 | ❌ |
+| Access Control | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | 📖 | ❌ |
+| Network Routing | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | 📖 | ❌ |
+| DNS | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | 📖 | ❌ |
+| Peers | ✅ | ✅ | 📖 | 📖 | ❌ | 📖 | 📖 | 📖<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>1</sup> |
+| Setup Keys | ✅ | ✅ | 📖 | ❌ | ❌ | ❌ | 📖 | ❌ |
+| Team | ✅ | ✅ | 📖 | 📖 | ❌ | 📖 | 📖 | ❌ |
+| Activity | ✅ | ✅ | 📖 | ❌ | ❌ | ❌ | 📖 | ❌ |
+| Settings | ✅ | ✅ | 📖 | ❌ | ✅<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>2</sup> | ❌ | 📖 | ❌ |
+| Agent Network | ✅ | ✅ | ❌ | ✅ | ❌ | 📖<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>3</sup> | 📖 | ❌<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>4</sup> |
+| Reverse Proxy | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | 📖 | ❌ |
+| Tenants | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | 📖 | ❌ |
+| Integrations | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | 📖 | ❌ |
 
 **Legend:** ✅ = Full access · 📖 = Read only · ❌ = No access
 
 <sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>1</sup> A `User` can only see the peers they own and peers they're allowed to connect to.
 
 <sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>2</sup> A `Billing Admin`'s Settings access is limited to **Plans & Billing** and **Invoices**.
 
+<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>3</sup> A `Usage Viewer`'s Agent Network access is limited to the aggregated usage and cost overview and a read-only view of the provider list (the provider and model filter options).
+
+<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>4</sup> Every user, regardless of role, can see their own Agent Network usage and requests, and the connection details their access policies allow (endpoint, providers, models) - the usage and log APIs answer with the caller's own data when the role has no account-wide access.
+
 ## Owner
 The `Owner` has full access to the account and can manage every aspect of it. There can be only one account owner in NetBird. Owners are the only users who can delete the organization account - see [Delete NetBird account](/manage/settings/delete-account) for more.
 
@@ -40,14 +45,20 @@ An `Admin` has full access to the account, with two exceptions: administrators c
 ## Network Admin
 A `Network Admin` fully manages network configuration - Control Center, Access Control, Network Routing, and DNS. They have read-only access to Peers, Setup Keys, Team, Activity, and Settings, and no access to Reverse Proxy, Tenants, or Integrations. A `Network Admin` can view setup keys but not create them, and can't invite users or create service users.
 
+## Agent Network Admin
+An `Agent Network Admin` fully manages [Agent Network](/agent-network) - LLM providers, access policies, guardrails, budgets, usage, access logs, and its settings. They have read-only access to Peers and Team, needed to build access policies, and no access to anything else in the account: no network configuration, no setup keys, no billing.
+
+## Usage Viewer
+A `Usage Viewer` sees the [Agent Network](/agent-network) usage and cost overview, with per-user and per-group breakdowns, and nothing more. The role is meant for cost stakeholders - finance, team leads, project owners - who track LLM spend without administering anything. To make the usage filters and breakdowns work, the role carries read-only access to users, groups, peers, and the provider list. A `Usage Viewer` can't change any of those, sees no provider credentials or access policies, and no request-level access logs (which can contain captured prompts).
+
 ## Billing Admin
 A `Billing Admin` manages billing only. They can access `Settings` → `Plans & Billing` and `Settings` → `Invoices`, and have no access to any other part of the account.
 
 ## Auditor
 An `Auditor` can read every configuration in the account but can't modify anything.
 
 ## User
-A `User` has limited access: they can view the peers they own and other peers they're allowed to connect to.
+A `User` has limited access: they can view the peers they own and other peers they're allowed to connect to. Every user can also read the Agent Network connection details their access policies allow via the self-service endpoint (`GET /api/agent-network/me/setup`) and their own usage and requests through the regular usage and access-log endpoints, which answer with the caller's own data when the role has no account-wide access - no role change or admin involvement needed.
 
 ## Roles and the API
 Roles apply the same way whether a user works in the dashboard or through the [NetBird management API](/api) - a user's permissions over API resources match their role. Every role except `User` can create a personal access token that carries the same permissions as that user's role, so they can interact with the API programmatically.
@@ -62,9 +73,12 @@ To change a user's role, go to the `Team` tab, select the `Users` tab, and click
 <p>
   <img src="/docs-static/img/manage/team/user-tab-list.png" alt="user list in the Team tab" className="imagewrapper-big"/>
 </p>
-Select the desired role from the dropdown:
+Select the desired role from the dropdown. Roles are grouped by product surface: the `General` tab holds the account-wide roles, and the `Agent Network` tab holds the roles scoped to [Agent Network](/agent-network) (shown when Agent Network is available on the account):
+<p>
+  <img src="/docs-static/img/manage/team/user-update-role.png" alt="user role dropdown with the General tab selected" className="imagewrapper-big"/>
+</p>
 <p>
-  <img src="/docs-static/img/manage/team/user-update-role.png" alt="user role dropdown" className="imagewrapper-big"/>
+  <img src="/docs-static/img/manage/team/user-update-role-agent-network.png" alt="user role dropdown with the Agent Network tab selected" className="imagewrapper-big"/>
 </p>
 Click the `Save` button to apply the change.
 <Note>