# Billing access

Billing is kept apart from the Owner role. Learn which billing roles reach a billing account, who holds one from the start, and what an Owner can do without one.

Billing is deliberately separate from `roles/owner`. An Owner runs the organization’s infrastructure, but can’t view, create or change a billing account. That takes one of three billing roles, which keeps the people who spend money and the people who manage payment apart.

The following table shows which roles reach a billing account, and what an Owner can do without one.

| Role | Reaches the billing account with |
| --- | --- |
| `roles/billing/administrator` | Full access |
| `roles/billing/user` | All but delete |
| `roles/billing/viewer` | Read |
| `roles/owner` | No access to the billing account; it can switch which billing account a project is charged to |

## Billing roles [#billing-roles]

| Role | Allows |
| --- | --- |
| `roles/billing/administrator` | View, list, create, update and delete billing accounts. This includes billing details, payment methods and invoices. |
| `roles/billing/user` | Everything the administrator can do, except delete a billing account. |
| `roles/billing/viewer` | View and list billing accounts, including their invoices. |

Assign billing roles organization-wide, with no project: they govern billing accounts, which belong to the organization rather than to a project. A billing role assigned to a single project isn’t refused, but it isn’t supported and doesn’t give the access you’d expect.

To assign a role, see [Assign and revoke roles](/docs/iam/assign-roles). For example, to make someone a billing user:

```sh
origin iam assign-role --org-id <org-id> \
  --principal user:<user-id> \
  --role-urn urn:origin:cloud:iam::::tc/role/roles/billing/user
```

## Who holds a billing role from the start [#who-holds-a-billing-role-from-the-start]

Whoever creates an organization gets `roles/billing/administrator` on it, together with `roles/owner`. So the person who signs up can add a payment method right away.

Nobody else gets a billing role implicitly. A member you invite holds only the roles you assign, so an Owner you add has no billing access until you grant a billing role as well.

Only someone who holds the billing permissions can hand them out: you can assign or revoke a billing role only if you hold every permission it grants, so in practice `roles/billing/administrator`. An Owner without a billing role can’t give one to anyone, including itself. See [Who can assign a role](/docs/iam/access-model#who-can-assign-a-role).

## What the Owner role covers [#what-the-owner-role-covers]

Without a billing role, an Owner can still:

- Switch which billing account a project is charged to. See [Manage projects](/docs/platform/organizations/projects#change-a-projects-billing-account).
- Set, clear and read the organization’s spend limit.
- Read usage and cost reports.
- Read and set quota budgets on projects.

An Owner can’t read a billing account’s details, payment method or invoices, and can’t add a payment method.

## Related [#related]

- [Add a payment method](/docs/platform/billing/payment-method)
- [Built-in roles](/docs/iam/roles)
- [Assign and revoke roles](/docs/iam/assign-roles)