diff --git a/docs/platform/concepts/permissions.md b/docs/platform/concepts/permissions.md
index 6eee18a9..4d90d15c 100644
--- a/docs/platform/concepts/permissions.md
+++ b/docs/platform/concepts/permissions.md
@@ -8,53 +8,65 @@ To give users access to projects and services in your organizations, you grant t
   group of resources.
 * **Roles**: Sets of permissions that you can assign to a principal.
 
-Principals can be:
-* [Organization users](/docs/platform/howto/manage-org-users)
-* [Application users](/docs/platform/concepts/application-users)
-* [Groups](/docs/platform/howto/manage-groups)
+Principals are
+[organization users](/docs/platform/howto/manage-org-users),
+[application users](/docs/platform/concepts/application-users),
+and [groups](/docs/platform/howto/manage-groups).
 
-You can
-[grant access to principals at the project level](/docs/platform/howto/manage-permissions).
-You can also [add users to services](/docs/platform/howto/create_new_service_user).
+You can grant access to principals at the organization and project level.
 
-To grant access to resources at the organization level, you can
-make organization users [super admin](/docs/platform/howto/make-super-admin).
-Limit the number of users with this role as it gives unrestricted access to
-all organization resources including billing, admin, and all projects and services.
+To give users access to a specific service,
+[create service users](/docs/platform/howto/create_new_service_user).
 
-## Project roles
+## Organization roles and permissions
 
-You can grant the following roles for projects to principals.
+You can grant the following roles and permissions to principals at the organization level.
+Roles and permissions at this level apply to the organization and all units, projects,
+and services within it.
 
-|   Console name    |          API name           |                                                                                                                                                           Permissions                                                                                                                                                           |
-| ----------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Admin             | `admin`                     | <ul> <li> Full access to the project and all of its services. </li> </ul>                                                                                                                                                                                                                                                       |
-| Developer         | `developer`                 | <ul> <li> Create databases. </li> <li> View service connection information. </li> <li> Remove Aiven for OpenSearch® indexes. </li> <li> Create and change Aiven for Apache Kafka® topics. </li> <li> Create and change Aiven for PostgreSQL® connection pools. </li> <li> Create and change service database users. </li> </ul> |
-| Operator          | `operator`                  | <ul> <li> View project audit log. </li> <li> View project permissions. </li> <li>  Full access to all services in the project and their configuration. </li> </ul>                                                                                                                                                              |
-| Read only         | `read_only`                 | <ul> <li> View all services and their configuration. </li> </ul>                                                                                                                                                                                                                                                                |
-| Maintain services | `role:services:maintenance` | <ul> <li> Perform service maintenance updates. </li> <li> Change maintenance windows. </li> <li> Upgrade service versions. </li> </ul>                                                                                                                                                                                          |
-| Recover services  | `role:services:recover`     | <ul> <li> Add and remove  dynamic disk sizing and tiered storage. </li> <li> Change service plans. </li> <li> Fork services. </li> <li> Promote read replicas. </li> </ul>                                                                                                                                                      |
+### Organization roles
 
-Project admin do not have access to organization settings such as billing unless
-they are also a [super admin](/docs/platform/howto/make-super-admin).
+|          Console name           |             API name             |                                                                                                                                                                                                                                                Allowed actions                                                                                                                                                                                                                                                 |
+| ------------------------------- | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Organization member        | None | This is the default role for all organization users. **You cannot grant this role to users.** <br/> <br/> All non-managed organization users can: <ul> <li> Edit their profiles. </li> <li> Create organizations. </li> <li> Leave organizations. </li> <li> Add [allowed authentication methods](/docs/platform/howto/set-authentication-policies). </li> <li> Generate and revoke personal tokens, if allowed by the [authentication policy](/docs/platform/howto/set-authentication-policies). </li> <li> Enable and disable feature previews. </li> </ul> <br/> [Managed users](/docs/platform/concepts/managed-users) have more restrictions. |
+| Admin               | `role:organization:admin` | <ul> <li> Full access to the organization. </li> <li> View and change billing information. </li> <li> Change the authentication policy. </li> <li> Invite, deactivate, and remove organization users. </li> <li> Create, edit, and delete groups. </li> <li> Create and delete application users and their tokens. </li> <li> Add and remove domains. </li> <li> Add, enable, disable, and remove identity providers. </li> </ul>                                                                                                                                                                                            |
 
-## Project and service permissions
+### Organization permissions
 
-:::important
-Permissions are not yet fully supported in the Aiven Console. They are intended for
-use with the Aiven API, Aiven Provider for Terraform, and Aiven Operator for Kubernetes®.
-:::
+|          Console name           |             API name             |                                                                                                                                                                                                                                                Allowed actions                                                                                                                                                                                                                                                 |
+| ------------------------------- | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Manage application users        | `organization:app_users:write`   | <ul> <li> Create, edit, and delete application users. </li> <li> View all application users. </li> <li> Generate and revoke application tokens. </li> <li> List all application tokens. </li> </ul>                                                                                                                                                                                                                                                                                                            |
+| View organization audit log     | `organization:audit_logs:read`   | <ul> <li> View the audit log. </li> </ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| Manage domains                  | `organization:domains:write`     | <ul> <li> Add, edit, and remove domains. </li> <li> View all organization domains. </li> </ul>                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| Manage groups                   | `organization:groups:write`      | <ul> <li> Create, edit, and delete groups. </li> <li> Add organization and application users to groups. </li> <li> Remove organization and application users from groups. </li> </ul>                                                                                                                                                                                                                                                                                                                          |
+| Manage IdPs                     | `organization:idps:write`        | <ul> <li> Add, edit, enable, disable, and remove identity providers. </li> <li> View all identity providers for the organization. </li> </ul>                                                                                                                                                                                                                                                                                                                                                                  |
+| Manage organization users       | `organization:users:write`       | <ul> <li> Invite new users to the organization. </li> <li> View all invited users. </li> <li> Remove user invites. </li> <li> Deactivate, edit and delete [managed users](/docs/platform/concepts/managed-users). </li> <li> Remove non-managed users from the organization. </li> <li> Reset passwords for managed users. </li> <li> View all authentication methods for an organization user. </li> <li> Revoke tokens for managed users. </li> <li> View all tokens generated by managed users. </li> </ul> |
 
-You can grant the following permissions to principals. The actions listed for each
-permission apply to the project and all services within it.
+
+## Project roles and permissions
+You can grant the following roles and permissions to principals. Roles and permissions
+granted at this level apply to the project and all services within it.
+
+### Project roles
+
+|   Console name    |          API name           |                                                                                                                                                                                                                                                                        Permissions                                                                                                                                                                                                                                                                         |
+| ----------------- | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Admin             | `admin`                     | <ul> <li> Full access to the project and all of its services. </li> </ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| Developer         | `developer`                 | <ul> <li> View project event log. </li> <li> View project tags. </li> <li> View all services in the project. </li> <li> Create databases. </li> <li> View service connection information. </li>  <li> View integration endpoints. </li> <li> Remove Aiven for OpenSearch® indexes. </li> <li> Create and change Aiven for Apache Kafka® topics. </li> <li> Create and change Aiven for PostgreSQL® connection pools. </li> <li> Create and change service database users. </li> </ul>                                                                      |
+| Operator          | `operator`                  | <ul> <li> View project audit log. </li> <li> Add, edit, and delete project tags. </li> <li> View project tags. </li>  <li> View project permissions. </li> <li> Create, edit, and delete services and their configuration. </li> <li> Perform service maintenance updates. </li> <li> Create, edit, and delete project VPCs and peering connections. </li> <li> View project event log. </li> <li> Created, edit, and delete integration endpoints. </li> <li> Enable and disable service integrations. </li> <li> View integration endpoints. </li> </ul> |
+| Read only         | `read_only`                 | <ul> <li> View project event log. </li> <li> View project tags. </li> <li> View all services and their configuration. </li> <li> View integration endpoints. </li> </ul>                                                                                                                                                                                                                                                                                                                                                                                   |
+| Maintain services | `role:services:maintenance` | <ul> <li> Perform service maintenance updates. </li> <li> Change maintenance windows. </li> <li> Upgrade service versions. </li> </ul>                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| Recover services  | `role:services:recover`     | <ul> <li> Add and remove dynamic disk sizing and tiered storage. </li> <li> Change service plans. </li> <li> Fork services. </li> <li> Promote read replicas. </li> </ul>                                                                                                                                                                                                                                                                                                                                                                                  |
+
+### Project permissions
 
 |         Console name         |           API name            |                                                                                                                                                                       Allowed actions                                                                                                                                                                       |
 | ---------------------------- | ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| View project audit log       | `project:audit_logs:read`     | <ul> <li> View the log for the project. </li> <li> View all services in the project. </li> </ul>                                                                                                                                                                                                                                                            |
+| View project audit logs      | `project:audit_logs:read`     | <ul> <li> View the logs for the project. </li> <li> View all services in the project. </li> </ul>                                                                                                                                                                                                                                                           |
 | View project integrations    | `project:integrations:read`   | <ul> <li> View all integration endpoints for a project. </li> </ul>                                                                                                                                                                                                                                                                                         |
 | Manage project integrations  | `project:integrations:write`  | <ul> <li> Add and remove integration endpoints. </li> <li> Read and write integration secrets. </li> </ul>                                                                                                                                                                                                                                                  |
-| View project networking      | `project:networking:read`     | <ul> <li> View all project VPCs. </li> </ul>                                                                                                                                                                                                                                                                                                                |
-| Manage project networking    | `project:networking:write`    | <ul> <li> Add, edit, and remove project VPCs.  </li> </ul>                                                                                                                                                                                                                                                                                                  |
+| View project networking      | `project:networking:read`     | <ul> <li> View all project VPCs. </li> <li> List all peering connections. </li> </ul>                                                                                                                                                                                                                                                                       |
+| Manage project networking    | `project:networking:write`    | <ul> <li> Create, edit, and delete project VPCs and peering connections. </li> <li> View all project VPCs and peering connections. </li> </ul>                                                                                                                                                                                                              |
 | View project permissions     | `project:permissions:read`    | <ul> <li> View all users granted permissions to a project. </li> </ul>                                                                                                                                                                                                                                                                                      |
 | View services                | `project:services:read`       | <ul> <li> View all details for services in a project, except the service logs. </li> </ul>                                                                                                                                                                                                                                                                  |
 | Manage services              | `project:services:write`      | <ul> <li> Create and delete services. </li> <li> Power on and off services. </li> <li> Add and remove dynamic disk sizing and tiered storage. </li> <li> Change service plans. </li> <li> Change cloud regions. </li> <li> Fork services. </li> </ul>                                                                                                       |
@@ -62,4 +74,4 @@ permission apply to the project and all services within it.
 | Access data                  | `service:data:write`          | <ul> <li> Perform service queries through the API and Console. </li> <li> View query statistics and current queries. </li> <li> Manage service-specific features like Kafka Topics and Schemas, PostgreSQL and AlloyDB Omni connection pools, and OpenSearch indexes. </li> </ul>                                                                           |
 | View service logs            | `service:logs:read`           | <ul> <li> View logs for all services in the project. </li> </ul> **Service logs may contain sensitive information.**                                                                                                                                                                                                                                        |
 | View configuration secrets   | `service:secrets:read`        | <ul> <li> Read service configuration secrets such as keys. </li> </ul>                                                                                                                                                                                                                                                                                      |
-| Manage service users         | `service:users:write`         | <ul> <li> Create and delete service users. </li> <li> View and update connection information for services. </li> </ul>                                                                                                                                                                                                                                      |
+| Manage service users         | `service:users:write`         | <ul> <li> Create and delete service users. </li> <li> View all service users. </li> <li> View, update, and reset connection information for services. </li> </ul>                                                                                                                                                                                           |
diff --git a/docs/platform/howto/make-super-admin.md b/docs/platform/howto/make-super-admin.md
index 6f1702dc..12c931e6 100644
--- a/docs/platform/howto/make-super-admin.md
+++ b/docs/platform/howto/make-super-admin.md
@@ -4,11 +4,9 @@ title: Super admin
 
 import ConsoleLabel from "@site/src/components/ConsoleIcons"
 
-The super admin role has full access to an organization, its billing and settings, and all its organizational units, projects, and services.
+The super admin role is a special role that has unrestricted access to an organization and all of its resources. This role should be limited to as few users as possible for organization setup and emergency use. For daily administrative tasks, assign users the [organization admin role](/docs/platform/concepts/permissions) instead. Aiven also highly recommends enabling [two-factor authentication](/docs/platform/howto/user-2fa) for super admin.
 
-## Make a user a super admin
-
-To give a user full access to your organization:
+To make a user a super admin:
 
 1.  In the organization, click **Admin**.
 1.  Click <ConsoleLabel name="users"/>.
@@ -16,8 +14,3 @@ To give a user full access to your organization:
 
 To revoke super admin privileges for a user, follow the same steps and
 select **Revoke super admin**.
-
-## Related pages
-<!-- vale off -->
-- [Manage organization users](/docs/platform/howto/manage-org-users)
-- [Permissions](/docs/platform/concepts/permissions)
diff --git a/docs/platform/howto/manage-permissions.md b/docs/platform/howto/manage-permissions.md
index f51fb475..4e4d2383 100644
--- a/docs/platform/howto/manage-permissions.md
+++ b/docs/platform/howto/manage-permissions.md
@@ -5,9 +5,64 @@ title: Manage permissions
 import ConsoleLabel from "@site/src/components/ConsoleIcons"
 import {ConsoleIcon} from "@site/src/components/ConsoleIcons"
 
-You can give users and groups access to a project and the services in it by granting them roles and permissions for that project.
+You can grant [organization users](/docs/platform/howto/manage-org-users), [application users](/docs/platform/concepts/application-users), and [groups](/docs/platform/howto/manage-groups) access at the organization and project level through [roles and permissions](/docs/platform/concepts/permissions).
 
-## Grant project permissions to a user or group
+:::important
+When you remove permissions from a user or group, service credentials are not changed.
+Users can still directly access services if they know the service credentials. To prevent
+this type of access, reset all service passwords.
+:::
+
+## Organization permissions
+
+### Grant organization permissions to a user or group
+
+1. In the organization, click **Admin**.
+
+1. Click <ConsoleLabel name="orgpermissions"/>.
+
+1. Click **Grant permissions** and select **Grant to users** or **Grant to groups**.
+
+1. Select the users or groups, and the
+   [roles and permissions](/docs/platform/concepts/permissions) to grant.
+
+1. Click **Grant permissions**.
+
+### Change organization permissions for a user or group
+
+1. In the organization, click **Admin**.
+
+1. Click <ConsoleLabel name="orgpermissions"/>.
+
+1. For the user or group click <ConsoleLabel name="actions"/> >
+   <ConsoleIcon name="edit"/> **Edit permissions**.
+
+1. Add or remove permissions and click **Save changes**.
+
+### Remove all organization-level roles and permissions
+
+You can remove all organization-level permissions that you granted to a user or group.
+After removing the permissions, organization users have the
+[default access level](/docs/platform/concepts/permissions#organization-roles-and-permissions)
+to the organization.
+
+To remove all organization permissions for a user or group:
+
+1. In the organization, click **Admin**.
+
+1. Click <ConsoleLabel name="orgpermissions"/>.
+
+1. For the user or group click <ConsoleLabel name="actions"/> >
+   <ConsoleIcon name="delete"/> **Remove**.
+
+1. Click **Remove user** or **Remove group** to confirm.
+
+## Project permissions
+
+You can give users access to a specific project by granting them roles and permissions
+at the project level.
+
+### Grant project permissions to a user or group
 
 1. In the project, click <ConsoleLabel name="projectpermissions"/>.
 
@@ -19,7 +74,7 @@ You can give users and groups access to a project and the services in it by gran
 
 1. Click **Grant permissions**.
 
-## Change permissions for a user or group
+### Change permissions for a user or group
 
 1. In the project, click <ConsoleLabel name="projectpermissions"/>.
 
@@ -28,13 +83,7 @@ You can give users and groups access to a project and the services in it by gran
 
 1. Add or remove permissions and click **Save changes**.
 
-## Remove access to a project
-
-:::important
-When you remove permissions from a user or group, service credentials are not changed.
-Users can still directly access services if they know the service credentials. To prevent
-this type of access, reset all service passwords.
-:::
+### Remove all project-level roles and permissions
 
 To remove all permissions to a project:
 
diff --git a/src/components/ConsoleIcons/index.tsx b/src/components/ConsoleIcons/index.tsx
index 4ab14300..b5ca41b6 100644
--- a/src/components/ConsoleIcons/index.tsx
+++ b/src/components/ConsoleIcons/index.tsx
@@ -201,6 +201,12 @@ export default function ConsoleLabel({name}): ReactElement {
           <ConsoleIconWrapper icon={ConsoleIcons.people} /> <b>Permissions</b>
         </>
       );
+    case 'orgpermissions':
+      return (
+        <>
+          <ConsoleIconWrapper icon={ConsoleIcons.blockedPerson} /> <b>Permissions</b>
+        </>
+      );
     case 'users':
       return (
         <>