docs: document Builder, Scorch, and Tunneler permissions and roles

docs/api.md

@@ -50,16 +50,18 @@ schemas.
 ## Authentication
 
 If UI/API authentication is enabled (see
-[User Authn/Authz](user-administration.md)), API requests must include an
-auth token generated from the `Users` tab in the web UI, passed as the
-`X-phenix-auth-token` header:
+[Users and Authentication](user-administration.md)), API requests must include
+a token in the `X-Phenix-Auth-Token` header, prefixed with `Bearer`:
 
 ```http
-X-phenix-auth-token: ******
+X-Phenix-Auth-Token: Bearer <token>
 ```
 
-See [Generating User Authentication Tokens](user-administration.md#generating-user-authentication-tokens)
-for details.
+Get a token by signing in with `POST /api/v1/login`, or create a longer-lived
+one from the `Users` tab. See [Signing In](user-administration.md#signing-in)
+and [API Tokens](user-administration.md#api-tokens) for details. What a token
+can do depends on the user's role; see
+[Roles and Permissions](roles-and-permissions.md).
 
 ## Integrations
 

docs/configuration.md

@@ -637,8 +637,8 @@ that user should have is specified, and using that role name the appropriate
 RBAC permissions are copied from the role configuration into the user
 configuration.
 
-There are six (6) default role configurations that get created automatically,
-and are described [here](user-administration.md#roles). An example role
+phēnix creates a set of default role configurations automatically, described
+[here](roles-and-permissions.md#built-in-roles). An example role
 configuration is shown below for completeness.
 
 ```yaml
@@ -764,6 +764,14 @@ or experiment configuration using a graphical interface. It is based on the
 `minibuilder` app in `minimega`. Users can access the Builder app via the
 `Builder` tab in the phēnix UI.
 
+Opening the Builder and saving topology files locally needs the
+[`builder`](roles-and-permissions.md#resource-builder) `get` permission, which
+every built-in viewer role has. Creating or updating experiments from the
+Builder, and importing topologies from phēnix, also need `experiments` and
+`configs` permissions; the built-in
+[Builder role](roles-and-permissions.md#builder-builder) has everything the
+Builder uses.
+
 ### Creating or Editing a Topology
 
 When Builder opens, it does so in a new configuration. If a user wanted to open