Billing Account Role-Based Access Control (RBAC)
Control who can manage billing accounts, assign organizations, and configure billing roles.
Overview
Billing accounts have their own RBAC system, separate from organization-level roles. This means:
- Billing roles are independent from organization roles — a user can have different levels of access to billing and to an organization.
- Billing permissions control who can view, edit, and delete billing accounts, assign organizations to accounts, and manage billing roles themselves.
Billing Permissions Reference
There are 7 billing account permissions:
| Permission | Description |
|---|---|
billing_account:read | View billing account details |
billing_account:write | Edit billing account settings |
billing_account:delete | Delete the billing account |
billing_account:assign | Assign organizations to the billing account |
billing_account:role:read | View billing account roles |
billing_account:role:write | Create and edit billing account roles |
billing_account:role:delete | Delete billing account roles |
Managing Billing Roles
Navigate to Billing and select a billing account to manage its roles.
Viewing Roles
The Account roles section displays all roles for the billing account, showing the role name, description, and available actions.
Creating a Role
- Click Create account role.
- Enter a name and description.
- Select the permissions to include.
- Click Create to save the role.
Editing a Role
- Click the edit action on the role row.
- Modify the name, description, or permissions as needed.
- Click Save to apply changes.
Protected roles cannot be edited.
Deleting a Role
- Click the delete action on the role row.
- Confirm the deletion.
Note: You cannot delete your own role.
Managing Billing Users
The Account users section on the billing account page shows all users with access to the account.
Viewing Users
Each row displays the user's email address and their assigned billing role.
Adding a User
- In the add user form, enter the user's email address.
- Select a billing role from the dropdown.
- Click Add to grant access.
Removing a User
- Click the remove action on the user row.
- Confirm the removal.
Note: You cannot remove yourself from the billing account.