help: Improve Roles and permissions page.

- Edit role descriptions and surrounging content.
- Add instructions for modifying roles and managing permissions.

help/roles-and-permissions.md

@@ -1,48 +1,66 @@
 # Roles and permissions
 
-There are several possible roles in a Zulip organization.
+## User roles
 
-* **Organization owner**: Can manage users, public streams,
-  organization settings, and billing.
+User roles make it convenient to configure different permissions for different
+users in your organization. You can decide what role a user will have when you
+[send them an invitation](/help/invite-new-users), and later [change a user's
+role](/help/roles-and-permissions#change-a-users-role) if needed.
 
-* **Organization administrator**: Can manage users, public streams,
-  and organization settings.  Cannot create or demote organization
-  owners.
+!!! tip ""
 
-* **Moderator**: Have the permissions of full members; additionally,
-  many **Organization permissions** settings allow moderators to be
-  given additional privileges or do so by default.
+    Learn about [stream permissions](/help/stream-permissions), including
+    **public** and **private** streams.
 
-* **Member**: Has access to all public streams.  Member is the default
-  role for most users.  [Some organization
-  settings](/help/restrict-permissions-of-new-members) allow an
-  organization to restrict the permissions of **new members**; Members
-  who do not have those restrictions are called **full members**.
+* **Organization owner**: Can manage users, public streams, organization
+  settings, and billing. Organization owners can do anything that an
+  organization administrator can do.
 
-* **Guest**: Can only view or access streams they've been added to.
-  [Guest users](/help/guest-users) interact with public streams as
-  though they were private streams with shared history.  Cannot
-  create new streams or invite other users.
+* **Organization administrator**: Can manage users, public streams, and
+  organization settings. Cannot make someone an owner, or change an existing
+  owner's role.
+
+* **Moderator**: Can do anything that members can do, plus additional
+  permissions [configured](/help/roles-and-permissions#manage-permissions) by
+  your organization.
+
+* **Member**: This is the default role for most users. Members have access to
+  all public streams. You can [configure different
+  permissions](/help/restrict-permissions-of-new-members) for **new members**
+  and **full members**, which is especially useful for [moderating open
+  organizations](/help/moderating-open-organizations). New members automatically
+  become full members after a configurable waiting period.
+
+* **Guest**: Can view and send messages in streams they have been added to.
+  Guests cannot see other streams, unless they have been specifically added to
+  the stream. See [guest users documentation](/help/guest-users) for additional
+  details and configuration options.
 
 * **Billing administrator**: The user who upgrades the organization to
   a paid plan is, in addition to their normal role, a billing
-  administrator.  Can manage billing in addition to the existing
-  privileges.  This allows someone from the billing department to
-  manage billing without needing organization administrator
-  permissions.
+  administrator.  Billing administrators can manage billing for the organization.
+  For example, someone from your billing department can be a **billing
+  administrator**, but not an **administrator** for the organization.
 
-For details of the access control model, see [Stream
-permissions](/help/stream-permissions).  You can decide what role to
-invite a user as when you [send them an
-invitation](/help/invite-new-users).
+## Change a user's role
 
-Organization owners can do anything an organization administrator can
-do.  For brevity, we may sometimes refer to "organization
-administrators" being able to do something; unless stated explicitly,
-this means "organization owners and administrators" can do that thing.
+{!change-a-users-role.md!}
+
+## Manage permissions
+
+{start_tabs}
+
+{settings_tab|organization-permissions}
+
+1. Review organization permissions, and modify as needed.
+
+{!save-changes.md!}
+
+{end_tabs}
 
 ## Related articles
 
+* [Change a user's role](/help/change-a-users-role)
 * [Stream permissions](/help/stream-permissions)
 * [Inviting new users](/help/invite-new-users)
 * [Zulip Cloud billing](/help/zulip-cloud-billing)