docs: clarify use-case

Author: iru

use-cases/org-three-way-k8s.md

@@ -7,11 +7,15 @@ With EKS as workload-type.
 <br/>This is terraform-based guidelines, but can also check [Manual Organizational Setup - Three-Way Cross-Account ](./manual-org-three-way.md)
 
 - **User Infrastructure Setup**:
-    1. Management Account
-    - Organizational Cloudtrail with no SNS activation
+
+This is the scenario we're going to recreate
+
+    1. Management Account / Accounts
+    - Eithere there is an Organizational Cloudtrail reporting to the log archive account
+    - Or several accounts reporting to the same log archive account
     2. Log Archive Account
     - Cloudtrail-S3 bucket, with event notification to an SNS > SQS
-    3. Member Account
+    3. Workload/Security Member Account
     - Sysdig Secure for cloud deployment
     - Existing K8S Cluster
       - permission setup rely on an `accessKey/secretAccessKey` parameters of the workload, but can setup the