Rewritten

Signed-off-by: Lee Calcote <lee.calcote@layer5.io>

Author: leecalcote

content/en/cloud/security/roles.md

@@ -1,11 +1,12 @@
 ---
 title: Roles
 description: >
-  A role contains a set of permissions that allows you to perform specific actions on Layer5 Cloud resources. To make permissions available to principals, including users, you grant roles to the principals.
+  Roles map permissions to users. Roles contain any number of keychains, which contain any number of keys (permissions). Assign roles to users to grant permissions. 
 date: 2023-10-30
 categories: [Security]
 tags: [roles, permissions]
 ---
+Roles map permissions to users. Roles contain any number of keychains, which contain any number of keys (permissions). Assign roles to users to grant permissions.
 
 ## Provider Admin Role
 
@@ -44,19 +45,24 @@ tags: [roles, permissions]
 {{% card header="Organization Adminstrator" %}}
 
 **What is the purpose of this role?**
+
 - Administration of an organization
 
 **Who can assign this role?**
+
 - The Organization Owner
 
 **When this role first assigned?**
+
 - Creation of new organization or User Account creation
 
 **How many instances of these roles?**
+
 - Min: 1, Max: many (based on plan)
 - By default, the first Organization Admin is the owner (the creator of the organization).
 
 **Who can remove assignment of this role?**
+
 - Organization Owner
 
 {{% /card %}}
@@ -86,8 +92,12 @@ tags: [roles, permissions]
 {{< /cardpane >}}
 
 {{< alert title="Organization owners as entitlements" >}}
-It's essential to understand that organization owners are not roles but entitlements. These entitlements are automatically assigned to the user who creates an organization. They are granted certain administrative privileges within the organization, allowing them to manage its settings and members effectively, including the administrative privilege to delete the organization.
-<br><br>
+It's essential to understand that owners are not roles, but entitlements.
+
+Organization owners carry the organization administrator role, and may be joined in their organization administration duties by any number of other users carrying the organization administrator role. However, the organization owner also has the administrative privilege to delete the organization.
+
+The entitlement of "organization owner" is automatically bestowed to the creator of a organization. The individual user who created a given organization initially is therefore granted certain administrative privileges beyond that of other organization administrators. Specifically, organization owners retain the sole permission to delete the organization.
+
 For more information, see [Organization](/cloud/identity/organizations).
 {{< /alert >}}
 
@@ -96,12 +106,15 @@ For more information, see [Organization](/cloud/identity/organizations).
 {{< cardpane >}}
 {{% card header="Team Adminstrator" %}}
 **What is the purpose of this role?**
+
 - Administration of teams
 
 **Who can assign and unassign this role?**
+
 - Organization Administrator or Team owner
 
 **When this role first assigned?**
+
 - Creation of new team or User Account creation
 - By default, the first Team Admin is owner (the team creator)
 
@@ -111,22 +124,30 @@ Min: 1, Max: many
 {{% /card %}}
 {{% card header="Team Manager" %}}
 **What is the purpose of this role?**
+
 - Administration of teams (without delete access)
 
 **Who can assign and unassign this role?**
+
 - Organization Administrators or Team Owner
 
 **When this role first assigned?**
+
 - Manually by Organization Administrator or Team Owner
 
 **How many instances of these roles?**
+
 - Min: 0, Max: many
 {{% /card %}}
 {{< /cardpane >}}
 
-{{< alert title="Team owners as entitlements" >}}
-It's essential to understand that team owners are not roles but entitlements. These entitlements are automatically assigned to the user who creates an team within an organization. They are granted certain administrative privileges within the team, allowing them to manage its settings and members effectively, including the administrative privilege to delete the team.
-<br><br>
+{{< alert title="Owners as entitlements, not roles" >}}
+It's essential to understand that owners are not roles, but entitlements.
+
+Team owners carry the team administrator role, and may be joined in their team administration duties by any number of other users carrying the team administrator role. However, the team owner also has the administrative privilege to delete the team.
+
+The entitlement of "team owner" is automatically bestowed to the creator of a team. The individual user who created a given team initially is therefore granted certain administrative privileges beyond that of other team administrators. Specifically, team owners retain the sole permission to delete the team.
+
 For more information, see [Teams](/cloud/identity/teams).
 {{< /alert >}}