diff --git a/fern/security-and-privacy/sso.mdx b/fern/security-and-privacy/sso.mdx
index dbb581381..cc36a3643 100644
--- a/fern/security-and-privacy/sso.mdx
+++ b/fern/security-and-privacy/sso.mdx
@@ -22,6 +22,20 @@ Once SSO is enabled for your organization, Vapi provides your IT administrator w
 
 Vapi does **not** support SCIM provisioning. When a user signs up, they create their own Vapi account; your IT administrator then invites them into your organization. Permissions are managed within Vapi using **Role-Based Access Control (RBAC)** at the application layer.
 
+## Role-based access control (RBAC)
+
+RBAC controls what each member can do in your organization. You assign a role when you invite a member to your organization.
+
+Three roles are available:
+
+| Role | Access |
+|------|--------|
+| **Admin** | Read and write everything |
+| **Editor** | Read and write everything **except** Org Settings, Billing, Members, and API Keys. |
+| **Viewer** | Read-only access to everything **except** Org Settings, Billing, Members, and API Keys. |
+
+Use **Editor** to give developers full build and test access without exposing billing or member management. 
+
 ## Need help?
 
 To enable SSO or ask about configuration, talk to the [Vapi sales team](/enterprise/plans).