diff --git a/.spelling b/.spelling
index f744bd451252..9bc694271835 100644
--- a/.spelling
+++ b/.spelling
@@ -113,6 +113,7 @@ Risc-V
 Roadmap
 RoleBinding
 SDKs
+SSO
 SageMaker
 ServiceAccount
 Sharding
@@ -257,6 +258,7 @@ v3.4.
 v3.4.4
 v3.5
 v3.6
+v3.6.5
 v3.7
 validator
 vendored
diff --git a/docs/workflow-actor.md b/docs/workflow-actor.md
new file mode 100644
index 000000000000..be5fb9684cf6
--- /dev/null
+++ b/docs/workflow-actor.md
@@ -0,0 +1,29 @@
+# Workflow Actor
+
+> v3.6.5 and after
+
+If argo workflow has setup [SSO](argo-server-sso.md), when you perform an action on the argo workflow related resource (Workflow, CronWorkflow, WorkflowTemplate, ClusterWorkflowTemplate) via the CLI or UI, an attempt will be made to label it with the user and their action.
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  name: my-wf
+  labels:
+    workflows.argoproj.io/actor: admin
+    # labels must be DNS formatted, so the "@" is replaces by '.at.'  
+    workflows.argoproj.io/creator-email: admin.at.your.org
+    workflows.argoproj.io/actor-preferred-username: admin-preferred-username
+    workflows.argoproj.io/action: Update
+```
+
+Available actions:
+
+- Update
+- Suspend
+- Stop
+- Terminate
+- Resume
+
+!!! NOTE
+    Labels only contain `[-_.0-9a-zA-Z]`, so any other characters will be turned into `-`.
diff --git a/mkdocs.yml b/mkdocs.yml
index c32b5996dca1..0a2e7a0de39d 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -135,6 +135,7 @@ nav:
           - estimated-duration.md
           - progress.md
           - workflow-creator.md
+          - workflow-actor.md
       - Patterns:
           - empty-dir.md
           - cron-backfill.md