Update and clarify NGINX One RBAC docs

Author: tstraley

content/nginx-one/rbac/rbac-api.md

@@ -7,15 +7,15 @@ product: NGINX One
 docs: DOCS-000
 ---
 
-Beyond [Default roles]({{< relref "/nginx-one/rbac/roles.md" >}}), you may need to set up custom roles. For convenience, we include a list of API groups that you could use to specify permissions for custom roles.
+Beyond the [Default roles]({{< relref "/nginx-one/rbac/roles.md" >}}) for NGINX One Console access, there may be cases where creating [custom roles](https://docs.cloud.f5.com/docs-v2/administration/how-tos/user-mgmt/roles#custom-roles) with more precisely defined access is desired. For this use-case, we include a list of API Groups that can be used to specify permissions for custom roles with more granular access controls to NGINX One Console APIs.
 
-These are not NGINX One APIs.
+Custom roles can be assigned to users or service accounts, and associated with specific namespaces, offering a way to maintain principle of least privilege across your tenant.
 
 ## F5 API groups for NGINX One
 
-The following table lists the **[F5 XC roles](https://docs.cloud.f5.com/docs-v2/administration/how-tos/user-mgmt/roles)** that you can use. These are narrowly scoped API Groups that align with all the features and functionality within the NGINX One Console. These groups can help you create custom roles tailored to your specific needs.
+The following table lists the available API Groups that you can use to construct a Role. These are narrowly scoped API Groups that align with all the features and functionality within the NGINX One Console. These groups can help you create custom roles tailored to your specific needs.
 
-{{< note >}}If you create custom roles using the more granular API Groups, users may not have access until you add the corresponding API Groups to their roles.{{< /note >}}
+{{< note >}}If you create custom roles using these API Groups, users may not have access to all capabilities of the UI Console.{{< /note >}}
 
 | API Group Name                          | Level of Access | Description                                                                                                                   |
 |-----------------------------------------|-----------------|-------------------------------------------------------------------------------------------------------------------------------|
@@ -27,7 +27,7 @@ The following table lists the **[F5 XC roles](https://docs.cloud.f5.com/docs-v2/
 | f5xc-nginx-one-custom-all-instances-manage          | Write           | View and delete all Instances.                                                                                                |
 | f5xc-nginx-one-custom-instance-manage               | Write           | View and edit Instance details.                                                                        |
 | f5xc-nginx-one-custom-instance-read                 | Read            | View Instance and configuration details.                                                                        |
-| f5xc-nginx-one-custom-certificate-manage            | Write           | View TSL/SSL certificate details. Create, update, and delete any managed certificates.                                    |
+| f5xc-nginx-one-custom-certificate-manage            | Write           | View TLS/SSL certificate details. Create, update, and delete any managed certificates.                                    |
 | f5xc-nginx-one-custom-certificate-read              | Read            | View TLS/SSL certificates.                                                                                    |
 | f5xc-nginx-one-custom-all-certificates-manage       | Write           | View all TLS/SSL certificates. Delete managed certificates.                                               |
 | f5xc-nginx-one-custom-data-plane-key-manage         | Write           | View, create, update, and delete any Data Plane Keys. Note: The actual Data Plane Key is shown _only_ when created. |

content/nginx-one/rbac/roles.md

@@ -13,7 +13,7 @@ We provide three default **[roles](https://docs.cloud.f5.com/docs-v2/administrat
 
 ### Admin
 
-The Admin role, identified as <code>f5xc-nginx-one-admin</code>, provides full read and write access to all endpoints and features within the NGINX One Console.
+The Admin role, identified as <code>f5xc-nginx-one-admin</code>, provides full read and write access to all endpoints and features within the NGINX One Console, and related services.
 
 ### User