I've put a link to the definitions of the ClusterRoles. That should be enough, unless some specific permission needs additional context. As for how CRT creates the resources, I'm not sure that it would fall under the AppStudio doc. Is there specific information you had in mind?
Add information about the new appstudio-pipeline service account.