Mention fallback

docs/feature-roles.asciidoc

@@ -340,6 +340,8 @@ See {kibana-ref}/apm-app-central-config-user.html[{apm-app} central configuratio
 [[privileges-rum-source-mapping]]
 ==== APM Server RUM source mapping
 
+If <<configuration-rum,real user monitoring>> is enabled, additional privileges are required to read source maps.
+
 To grant an APM Server user with the required privileges for reading RUM source maps from {es} directly without {kib},
 assign the user the following privileges:
 
@@ -352,6 +354,12 @@ assign the user the following privileges:
 |Allow {beatname_uc} to read RUM source maps from {es}
 |====
 
+The above privileges should be sufficient for RUM source mapping to work properly
+as long as {beatname_uc} communicates with {es} successfully.
+If it fails, it may fallback to read source maps via {kib} if configured,
+which requires additional {kib} privileges.
+See {kibana-ref}/rum-sourcemap-api.html[RUM source map API] for more details.
+
 ////
 ***********************************  ***********************************
 ***********************************  ***********************************