diff --git a/docs/netbird-zero-trust.md b/docs/netbird-zero-trust.md
index 908748e..f53d45e 100644
--- a/docs/netbird-zero-trust.md
+++ b/docs/netbird-zero-trust.md
@@ -120,20 +120,5 @@ Events:
 
 The network map updating on its own, unprompted, on a peer that isn't even the control plane, is the mesh's policy engine actually pushing live state to every connected peer — not a dashboard claiming a policy exists.
 
-## Rollout, phased and honestly incomplete
-
-Not everything is finished, and that's stated plainly rather than rounded up:
-
-| Phase | Scope | State |
-|---|---|---|
-| Control plane + dashboard, embedded identity | Stand up the mesh itself | Done |
-| First peers | Laptop + one fleet host, verified on-LAN | Done |
-| Fleet enrolment | Every fleet host via the dedicated role | Done |
-| Roaming | Split-DNS (done) + full-LAN route + off-LAN verification | Partly done |
-| Zero-trust policy | Groups, keys, deny-by-default, approval, posture, login expiry | Done |
-| Enforcement | Per-host firewall rejects non-mesh admin access | Planned |
-
-The honest gaps: off-LAN connectivity (STUN/relay through NAT) hasn't been verified end-to-end yet, the full internal-network route for agent-less devices is still open, and per-host firewall enforcement — actually *requiring* the mesh for admin access rather than just offering it as one more path — is a deliberate later phase, not an oversight. A phased rollout that's honest about which phases aren't done yet is worth more than a status page that rounds every in-progress item up to "complete."
-
 ---
 Related: [`docs/iac-pipeline.md`](iac-pipeline.md), [`docs/architecture-overview.md`](architecture-overview.md), [`docs/firewall-and-network.md`](firewall-and-network.md), [`docs/secrets-and-pki.md`](secrets-and-pki.md), [`docs/dns-naming.md`](dns-naming.md)