diff --git a/modules/iam-service-account/README.md b/modules/iam-service-account/README.md
index 69c06154d..cbe15b11e 100644
--- a/modules/iam-service-account/README.md
+++ b/modules/iam-service-account/README.md
@@ -24,8 +24,6 @@ module "myproject-default-service-accounts" {
 }
 # tftest:modules=1:resources=5
 ```
-
-
 <!-- BEGIN TFDOC -->
 
 ## Variables
@@ -38,9 +36,9 @@ module "myproject-default-service-accounts" {
 | display_name | Display name of the service account to create. | <code>string</code> |  | <code>&#34;Terraform-managed.&#34;</code> |
 | generate_key | Generate a key for service account. | <code>bool</code> |  | <code>false</code> |
 | iam | IAM bindings on the service account in {ROLE => [MEMBERS]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| iam_billing_roles | Project roles granted to the service account, by billing account id. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| iam_folder_roles | Project roles granted to the service account, by folder id. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| iam_organization_roles | Project roles granted to the service account, by organization id. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| iam_billing_roles | Billing account roles granted to the service account, by billing account id. Non-authoritative. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| iam_folder_roles | Folder roles granted to the service account, by folder id. Non-authoritative. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| iam_organization_roles | Organization roles granted to the service account, by organization id. Non-authoritative. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | iam_project_roles | Project roles granted to the service account, by project id. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | iam_storage_roles | Storage roles granted to the service account, by bucket name. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | prefix | Prefix applied to service account names. | <code>string</code> |  | <code>null</code> |
@@ -58,4 +56,3 @@ module "myproject-default-service-accounts" {
 | service_account_credentials | Service account json credential templates for uploaded public keys data. |  |
 
 <!-- END TFDOC -->
-
diff --git a/modules/iam-service-account/variables.tf b/modules/iam-service-account/variables.tf
index f906baa61..45cb84970 100644
--- a/modules/iam-service-account/variables.tf
+++ b/modules/iam-service-account/variables.tf
@@ -39,19 +39,19 @@ variable "iam" {
 }
 
 variable "iam_billing_roles" {
-  description = "Project roles granted to the service account, by billing account id."
+  description = "Billing account roles granted to the service account, by billing account id. Non-authoritative."
   type        = map(list(string))
   default     = {}
 }
 
 variable "iam_folder_roles" {
-  description = "Project roles granted to the service account, by folder id."
+  description = "Folder roles granted to the service account, by folder id. Non-authoritative."
   type        = map(list(string))
   default     = {}
 }
 
 variable "iam_organization_roles" {
-  description = "Project roles granted to the service account, by organization id."
+  description = "Organization roles granted to the service account, by organization id. Non-authoritative."
   type        = map(list(string))
   default     = {}
 }