docs: viewer role (cube-js#10444)

Author: keydunov

docs/content/product/administration/users-and-permissions/roles-and-permissions.mdx

@@ -2,48 +2,29 @@
 
 _Understanding user roles and permissions in Cube._
 
-Cube has three built-in default roles: Admin, Developer, and Explorer. Each role has specific permissions and access levels designed to support different responsibilities within the platform.
+Cube has four built-in default roles: Admin, Developer, Explorer, and Viewer. Each role has specific permissions and access levels designed to support different responsibilities within the platform.
 
 The Enterprise tier allows creation of custom roles with a customized set of permissions tailored to your organization's specific needs.
 
+## Permissions matrix
 
-## Default Roles
-
-### Admin Role
-
-- Has highest level of privileges
-- Can manage semantic models
-- Can manage other users
-- Has access to admin section
-- Full query capabilities
+| Permission                          | Admin | Developer | Explorer | Viewer |
+| ----------------------------------- | :---: | :-------: | :------: | :----: |
+| Manage users and account settings           |   ✅   |     ❌     |    ❌     |   ❌    |
+| Manage deployments and their settings |   ✅   |     ✅     |    ❌     |   ❌    |
+| Edit semantic model     |   ✅   |     ✅     |    ❌     |   ❌    |
+| Execute SQL queries against data sources |   ✅   |     ✅     |    ❌     |   ❌    |
+| Explore and query semantic models               |   ✅   |     ✅     |    ✅     |   ❌    |
+| Create and edit workbooks           |   ✅   |     ✅     |    ✅     |   ❌    |
+| View published dashboards           |   ✅   |     ✅     |    ✅     |   ✅    |
+| Access Analytics Chat               |   ✅   |     ✅     |    ✅     |   ✅    |
+| Query from external tools (Tableau, Power BI) |   ✅   |     ✅     |    ✅     |   ✅    |
 
 <InfoBox>
-Admin roles are billed at the developer rate.
-</InfoBox>
-
-### Developer Role
-
-- Can create and edit semantic models
-- Can execute SQL queries against data sources
-- Can create and edit workbooks
-- Can create and edit data apps
-- No access to admin settings
 
-### Explorer Role
-
-- Can query semantic models
-- Can create and edit workbooks
-- Can create and edit data apps
-- Can execute Semantic SQL queries
-- Cannot make changes to semantic models
-- Cannot query source data directly
-
-## Future Implementation
-
-A Viewer role is planned for future implementation with the following capabilities:
+Admin roles are billed at the developer rate.
 
-- Use Analytics Chat with ability to query Semantic Views and existing reports
-- View (read-only) access to shared data apps
+</InfoBox>
 
 ## Agent Permissions