more edits on trusted exception

Author: HeidiSteen

articles/search/service-configure-firewall.md

@@ -130,12 +130,12 @@ Workflows for this network exception are requests originating *from* Azure AI St
 
 ### Trusted resources must have a managed identity
 
-For managed identities on Azure OpenAI and Azure Machine Learning:
+To set up managed identities for Azure OpenAI and Azure Machine Learning:
 
 + [How to configure Azure OpenAI Service with managed identities](/azure/ai-services/openai/how-to/managed-identity)
 + [How to set up authentication between Azure Machine Learning and other services](/azure/machine-learning/how-to-identity-based-service-authentication).
 
-For managed identities on Azure AI services:
+To set up a managed identity for an Azure AI service:
 
 1. [Find your multiservice account](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.cognitiveServices%2Faccounts).
 1. On the leftmost pane, under **Resource management**, select **Identity**.
@@ -145,7 +145,11 @@ For managed identities on Azure AI services:
 
 Once your Azure resource has a managed identity, [assign roles on Azure AI Search](keyless-connections.md) to grant permissions to data and operations. 
 
-The application layer of a RAG solution typically needs query-only permissions (Search Index Data Reader) on Azure AI Search. But the trusted services are used for vectorization workloads: generating vectors from text and image content, and sending payloads back to the search service for query execution or indexing. If you need to load a search index with vectors generated by an embedding model, assign the Search Index Data Contributor role to your trusted resource.
+The trusted services are used for vectorization workloads: generating vectors from text and image content, and sending payloads back to the search service for query execution or indexing. Connections from a trusted service are used to deliver payloads to Azure AI search.
+
++ To load a search index with vectors generated by an embedding model, assign **Search Index Data Contributor**.
+
++ To provide queries with a vector generated by an embedding model, assign **Search Index Data Reader**. The embedding used in a query isn't written to an index, so no write permissions are rquired.
 
 > [!NOTE]
 > This article covers the trusted exception for admitting requests to your search service, but Azure AI Search is itself on the trusted services list of other Azure resources. Specifically, you can use the trusted service exception for [connections from Azure AI Search to Azure Storage](search-indexer-howto-access-trusted-service-exception.md).