# Billing Account Role-Based Access Control (RBAC)

Control who can manage billing accounts, assign organizations, and configure billing roles.

## Overview

Billing accounts have their own RBAC system, separate from organization-level roles. This means:

- **Billing roles are independent** from organization roles — a user can have different levels of access to billing and to an organization.
- **Billing permissions** control who can view, edit, and delete billing accounts, assign organizations to accounts, and manage billing roles themselves.

## Billing Permissions Reference

There are 7 billing account permissions:

| Permission | Description |
|---|---|
| `billing_account:read` | View billing account details |
| `billing_account:write` | Edit billing account settings |
| `billing_account:delete` | Delete the billing account |
| `billing_account:assign` | Assign organizations to the billing account |
| `billing_account:role:read` | View billing account roles |
| `billing_account:role:write` | Create and edit billing account roles |
| `billing_account:role:delete` | Delete billing account roles |

## Managing Billing Roles

Navigate to **Billing** and select a billing account to manage its roles.

### Viewing Roles

The **Account roles** section displays all roles for the billing account, showing the role name, description, and available actions.

### Creating a Role

1. Click **Create account role**.
2. Enter a name and description.
3. Select the permissions to include.
4. Click **Create** to save the role.

### Editing a Role

1. Click the edit action on the role row.
2. Modify the name, description, or permissions as needed.
3. Click **Save** to apply changes.

Protected roles cannot be edited.

### Deleting a Role

1. Click the delete action on the role row.
2. Confirm the deletion.

**Note:** You cannot delete your own role.

## Managing Billing Users

The **Account users** section on the billing account page shows all users with access to the account.

### Viewing Users

Each row displays the user's email address and their assigned billing role.

### Adding a User

1. In the add user form, enter the user's email address.
2. Select a billing role from the dropdown.
3. Click **Add** to grant access.

### Removing a User

1. Click the remove action on the user row.
2. Confirm the removal.

**Note:** You cannot remove yourself from the billing account.