Add permissions section for adaptive sampling (#32234)

* Add permissions section for adaptive sampling

Added permissions section for adaptive sampling configuration, detailing user roles and access restrictions.

* Apply suggestions from code review

Co-authored-by: domalessi <111786334+domalessi@users.noreply.github.com>

* Added screenshots for granular access controls

* Move note section on access restriction permissions steps

Removed duplicate note about `remote_config_write` permission for adaptive sampling access.

* Update content/en/tracing/trace_pipeline/adaptive_sampling.md

---------

Co-authored-by: domalessi <111786334+domalessi@users.noreply.github.com>

Author: mervebolatdd

content/en/tracing/trace_pipeline/adaptive_sampling.md

@@ -132,6 +132,31 @@ To onboard a service to adaptive sampling:
 
 The configuration should take effect in 5-6 minutes, the time it takes for Datadog to observe the service's traffic pattern, compute, then apply the sampling rates. Resources that have been configured remotely display as `Configured Remote` in the **Configuration** column.
 
+## Permissions
+
+By default, only users with the `Datadog Admin` role can modify adaptive sampling configurations or onboard services to adaptive sampling.
+
+If your organization uses custom roles, assign your user to a custom role that includes `APM Remote Configuration Write` and `APM Service Ingest Write` [permissions.][4]
+
+### Restrict access
+Use [granular access controls][19] to manage who can modify a service's adaptive sampling configuration. You can restrict access based on roles, teams, or individual users.
+
+{{< img src="/tracing/guide/adaptive_sampling/add_restriction.png" alt="Restrict permission modal" style="width:60%;">}}
+
+To restrict access:
+
+{{< img src="/tracing/guide/adaptive_sampling/restrict_service_ingestion_permissions.png" alt="Open granular access control modal" style="width:100%;">}}
+
+**Note**: Only users with the `remote_config_write` permission can restrict access to the adaptive sampling configuration of individual services.
+
+1. Open the **Permissions** section in the Ingestion Control side panel of the service.
+
+2. Click **Restrict access**.
+
+3. Select the teams, roles, or users to grant access to.
+
+4. Click **Add**.
+
 ## Further reading
 
 {{< partial name="whats-next/whats-next.html" >}}
@@ -154,3 +179,4 @@ The configuration should take effect in 5-6 minutes, the time it takes for Datad
 [16]: /tracing/trace_pipeline/ingestion_controls
 [17]: https://github.com/DataDog/dd-trace-php/releases/tag/1.4.0
 [18]: https://app.datadoghq.com/apm/traces/ingestion-control
+[19]: /account_management/rbac/granular_access/