[anhtho-lago]

Context

The public RBAC guide describes the predefined Finance & analyst role as "view-only." That no longer matches the current permissions: Finance can update customers and manage invoices, credit notes, billing entities, and dunning campaigns. The inaccurate description can mislead teams evaluating a finance-led Lago workflow.

Description

• Correct only the Finance & analyst paragraph in guide/security/rbac.mdx.
• State the operational permissions that exist today and the boundaries that remain: Finance cannot create or edit metrics or plans, or create or update subscriptions.
• Source of truth: current predefined permissions and customer update change.

Validation

• pnpm exec mint validate passed locally.
• git diff --check passed.
• GitHub validate and Mintlify Deployment checks passed.
• Hosted preview and its Markdown fallback both returned HTTP 200 and contain the corrected wording.

This is a one-page accuracy correction. It does not change role permissions or claim that Finance can run every billing setup step.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
lago-docs	🟢 Ready	View Preview	Oct 17, 2026, 5:33 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[sarkissianraffi]

No blockers.

What held up (checked against lago-api config/permissions.yml on main)

• Finance has customers: update, full invoice actions (create, update, void, send, export), credit note actions, billing_entities create/update/delete, and dunning_campaigns create/update/delete. All claimed abilities exist.
• Finance has only view on plans, subscriptions and coupons, and no billable_metrics create or update. The stated boundaries are correct.
• Old text called the role "view-only". That was wrong, so this fixes a real mismatch.

Non-blocking

• The list is not exhaustive. Finance also has payments create, organization update and invoice_custom_sections create/update/delete. Adding "and payments" would avoid underselling the role. The link to the full list covers it, so this is optional.
• The last sentence ("Assign a role with the relevant permissions") reads a little vague. "Use Manager or a custom role for those actions" would be clearer. Check that Manager does hold them before using that wording.
• I verified content only, not mint validate.

Merge order: independent of the other open PRs. Safe to merge.

---

Generated by Claude Code