AGENTS.md

@@ -214,10 +214,9 @@ Revisit only if the stated reason stops holding.
   grant-specific guards go with it: you cannot revoke your own **direct** grants (self-lockout would
   need a `curl` against Keto to undo), and a permission held *through a group* renders
   ticked-but-disabled, because unticked stated the opposite of the truth. The group paths are
-  guarded too: unticking a permission on a group you are in, removing yourself or a group you are in,
+  guarded too: unticking a permission on a group you are in, removing yourself (or a nested group you
-  or deleting the group is refused when you would lose a permission you don't hold directly. One also
+  are in) from its members, or deleting the group is refused when you would lose a permission you
-  held through another group counts as lost — telling them apart needs a reverse Keto query, and a
+  don't hold directly.
-  false refusal costs only asking another administrator.
 - **`users:write` and `groups:write` are equivalent to full administrative access**: `groups:write`
   adds you to any group, including one holding every permission; `users:write` mints a recovery code
   for any account. The containment the split buys is real on the **read** half only (`users:read` is

CHANGELOG.md

@@ -8,10 +8,11 @@ at boot. Entries start at 0.3.0.
 
 ### The admin example stops an administrator locking themselves out through a group
 
-On the Groups screen, unticking a permission on a group you are in, removing yourself or a group
+On the Groups screen, unticking a permission on a group you are in, removing yourself (or a nested
-you are in, or deleting the group is refused when it would take away a permission you don't hold
+group you are in) from its members, or deleting the group is refused when it would take away a
-directly. The page says so, and another administrator can make the change. A permission you also
+permission you don't hold directly. The page names the permissions, and another administrator can
-hold through another group counts as lost, so such a change is refused as well.
+make the change. The check errs towards refusing: it also refuses when you would keep the permission
+through another group, or keep your membership another way.
 
 ### The admin example titles a read-only user page "View user"