diff --git a/.github/.OwlBot.lock.yaml b/.github/.OwlBot.lock.yaml
index 98f19efe..419ccb9a 100644
--- a/.github/.OwlBot.lock.yaml
+++ b/.github/.OwlBot.lock.yaml
@@ -1,3 +1,3 @@
 docker:
   image: gcr.io/repo-automation-bots/owlbot-java:latest
-  digest: sha256:b3f8a219abf58ed4a775da5b90934b34f477b74f6f4e5d15781694dcc67b6f41
+  digest: sha256:2904b9ad921ecc1343d1cf815bfaafbcc1115c1f39593aef9f8e333ffda552f7
diff --git a/README.md b/README.md
index 237ee40c..08bdede9 100644
--- a/README.md
+++ b/README.md
@@ -8,9 +8,11 @@ Java idiomatic client for [Kubernetes Engine][product-docs].
 - [Product Documentation][product-docs]
 - [Client Library Documentation][javadocs]
 
+
 ## Quickstart
 
 If you are using Maven with [BOM][libraries-bom], add this to your pom.xml file
+
 ```xml
 <dependencyManagement>
   <dependencies>
@@ -34,6 +36,7 @@ If you are using Maven with [BOM][libraries-bom], add this to your pom.xml file
 
 If you are using Maven without BOM, add this to your dependencies:
 
+
 ```xml
 <dependency>
   <groupId>com.google.cloud</groupId>
@@ -44,17 +47,20 @@ If you are using Maven without BOM, add this to your dependencies:
 ```
 
 If you are using Gradle 5.x or later, add this to your dependencies
+
 ```Groovy
 implementation platform('com.google.cloud:libraries-bom:20.9.0')
 
 compile 'com.google.cloud:google-cloud-container'
 ```
 If you are using Gradle without BOM, add this to your dependencies
+
 ```Groovy
 compile 'com.google.cloud:google-cloud-container:1.5.0'
 ```
 
 If you are using SBT, add this to your dependencies
+
 ```Scala
 libraryDependencies += "com.google.cloud" % "google-cloud-container" % "1.5.0"
 ```
@@ -63,6 +69,10 @@ libraryDependencies += "com.google.cloud" % "google-cloud-container" % "1.5.0"
 
 See the [Authentication][authentication] section in the base directory's README.
 
+## Authorization
+
+The client application making API calls must be granted [authorization scopes][auth-scopes] required for the desired Kubernetes Engine APIs, and the authenticated principal must have the [IAM role(s)][predefined-iam-roles] required to access GCP resources using the Kubernetes Engine API calls.
+
 ## Getting Started
 
 ### Prerequisites
@@ -149,6 +159,7 @@ and on [google-cloud-java][g-c-j].
 This library follows [Semantic Versioning](http://semver.org/).
 
 
+
 ## Contributing
 
 
@@ -160,6 +171,7 @@ Please note that this project is released with a Contributor Code of Conduct. By
 this project you agree to abide by its terms. See [Code of Conduct][code-of-conduct] for more
 information.
 
+
 ## License
 
 Apache 2.0 - See [LICENSE][license] for more information.
@@ -192,6 +204,9 @@ Java is a registered trademark of Oracle and/or its affiliates.
 [maven-version-image]: https://img.shields.io/maven-central/v/com.google.cloud/google-cloud-container.svg
 [maven-version-link]: https://search.maven.org/search?q=g:com.google.cloud%20AND%20a:google-cloud-container&core=gav
 [authentication]: https://github.com/googleapis/google-cloud-java#authentication
+[auth-scopes]: https://developers.google.com/identity/protocols/oauth2/scopes
+[predefined-iam-roles]: https://cloud.google.com/iam/docs/understanding-roles#predefined_roles
+[iam-policy]: https://cloud.google.com/iam/docs/overview#cloud-iam-policy
 [developer-console]: https://console.developers.google.com/
 [create-project]: https://cloud.google.com/resource-manager/docs/creating-managing-projects
 [cloud-sdk]: https://cloud.google.com/sdk/