diff --git a/datacenter/ucp/2.2/guides/admin/manage-users/permission-levels.md b/datacenter/ucp/2.2/guides/admin/manage-users/permission-levels.md
index 552f39dbe8b..9b3ec762189 100644
--- a/datacenter/ucp/2.2/guides/admin/manage-users/permission-levels.md
+++ b/datacenter/ucp/2.2/guides/admin/manage-users/permission-levels.md
@@ -49,11 +49,15 @@ and any custom roles that administrators have created. In the **Roles**
 list, click a role to see the API operations that it uses. For example, the
 `Scheduler` role has two of the node operations, `Schedule` and `View`.
 
+## Create a custom role
+
 Click **Create role** to create a custom role and define the API operations
 that it uses. When you create a custom role, all of the APIs that you can use
 are listed on the **Create Role** page. For example, you can create a custom
-role that uses the node operations, `Update`, and `View`, and you might give
-it a name like "Node Operator".
+role that uses the node operations, `Schedule`, `Update`, and `View`, and you
+might give it a name like "Node Operator".
+
+![](../../images/custom-role.png)
 
 You can give a role a global name, like "Remove Images", which might enable 
 the **Remove** and **Force Remove** operations for images. You can apply a
diff --git a/datacenter/ucp/2.2/guides/images/custom-role.png b/datacenter/ucp/2.2/guides/images/custom-role.png
new file mode 100644
index 00000000000..b4d6b9aa15f
Binary files /dev/null and b/datacenter/ucp/2.2/guides/images/custom-role.png differ