Billing is deliberately separate from roles/owner. An Owner runs the organization’s infrastructure, but can’t view, create or change a billing account. That takes one of three billing roles, which keeps the people who spend money and the people who manage payment apart.
The following table shows which roles reach a billing account, and what an Owner can do without one.
| Role | Reaches the billing account with |
|---|---|
roles/billing/administrator | Full access |
roles/billing/user | All but delete |
roles/billing/viewer | Read |
roles/owner | No access to the billing account; it can switch which billing account a project is charged to |
Billing roles
| Role | Allows |
|---|---|
roles/billing/administrator | View, list, create, update and delete billing accounts. This includes billing details, payment methods and invoices. |
roles/billing/user | Everything the administrator can do, except delete a billing account. |
roles/billing/viewer | View and list billing accounts, including their invoices. |
Assign billing roles organization-wide, with no project: they govern billing accounts, which belong to the organization rather than to a project. A billing role assigned to a single project isn’t refused, but it isn’t supported and doesn’t give the access you’d expect.
To assign a role, see Assign and revoke roles. For example, to make someone a billing user:
origin iam assign-role --org-id <org-id> \
--principal user:<user-id> \
--role-urn urn:origin:cloud:iam::::tc/role/roles/billing/userWho holds a billing role from the start
Whoever creates an organization gets roles/billing/administrator on it, together with roles/owner. So the person who signs up can add a payment method right away.
Nobody else gets a billing role implicitly. A member you invite holds only the roles you assign, so an Owner you add has no billing access until you grant a billing role as well.
Only someone who holds the billing permissions can hand them out: you can assign or revoke a billing role only if you hold every permission it grants, so in practice roles/billing/administrator. An Owner without a billing role can’t give one to anyone, including itself. See Who can assign a role.
What the Owner role covers
Without a billing role, an Owner can still:
- Switch which billing account a project is charged to. See Manage projects.
- Set, clear and read the organization’s spend limit.
- Read usage and cost reports.
- Read and set quota budgets on projects.
An Owner can’t read a billing account’s details, payment method or invoices, and can’t add a payment method.