Update docs/engineering-guide/accounts-and-groups.md

docs/engineering-guide/accounts-and-groups.md

@@ -7,17 +7,16 @@ Linux accounts are generally stored and managed in Active Directory.
 There are several types of accounts, which are usually indicated by a
 prefix or suffix:
 
--   Normal accounts. No prefix or suffix. Older accounts are just last
-    names, newer accounts are LASTNAME_X, where X is the first letter of
-    the given name.
--   Global accounts (or gac-accounts). These have a `gac-` prefix. These are shared accounts where several people know the password. Note that some global accounts were originially experiment accounts and share the properties of experiment accounts
--   Administrator accounts. Marked with an `-adm` suffix.
--   External users. These start with an `ext-` prefix and are provided
-    to external users, ie. those who are not PSI employees.
--   Experiment accounts (or e-accounts). These start with `e` followed by the uid (+ some global accounts which where renamed later).
-    These are managed by the [Digital User Office (DUO)](https://duo.psi.ch).
-    The password is shared by all users involved in the experiment.
--   Service accounts. These come with an `svcusr-` prefix and are used for running services.
+-   __Normal Account__ - No prefix or suffix. Older accounts are just last names, newer accounts are LASTNAME_X, where X is the first letter of the given name.
+-   __Global Account (gac-accounts)__ - These have a `gac-` prefix. These are shared accounts where several people know the password. Note that some global accounts were originially experiment accounts and share the properties of experiment accounts
+
+!!! warning
+    GAC accounts __must not__ be used for administrative tasks (also see: AW-95-17-02 Logical Access Control). Therefore membership in groups granting such privilidges is not permitted.
+
+-   __Administrator Account__ - Marked with an `-adm` suffix.
+-   __External Users__ - These accounts start with an `ext-` prefix and are provided to external users, ie. those who are not PSI employees.
+-   __Experiment Account (e-accounts)__ - These start with `e` followed by the uid (+ some global accounts which where renamed later). These are managed by the [Digital User Office (DUO)](https://duo.psi.ch). The password is shared by all users involved in the experiment.
+-   __Service Account__ - These come with an `svcusr-` prefix and are used for running services.
 
 Official documentation on PSI IT account naming convention can be found [here](https://psi.service-now.com/psisp?sys_kb_id=c498a3cb1bff68502c5940498b4bcb44&id=kb_article_view&sysparm_rank=1&sysparm_tsqueryId=4877d78687cc1d10bc150d830cbb3540)
 
@@ -35,12 +34,9 @@ To be able to easily distinguish between the different account types, a user sha
 
 The passwords for all these users are found in the [Shared Core Linux Secret Store](https://gitea.psi.ch/lx/core-linux-secrets), except for `e22284` which is found in the [PSI e-account Password Manager](https://epwd.psi.ch/cred/detail/18556/).
 
-```{note}
-unx-lx_ext_users - this group does not yet contain all ext accounts (only the ones that are currently in the scope of IAM - this should be fixed by end of January 2025
-```
+!!! note
+    unx-lx_ext_users - this group does not yet contain all ext accounts (only the ones that are currently in the scope of IAM
 
-### Policies
-GAC accounts __must not__ be used for administrative tasks (also see: AW-95-17-02 Logical Access Control). Therefore membership in groups granting such privilidges is not permitted.
 
 ## UID Allocation