diff --git a/assets/vault-acl-policies.png b/assets/vault-acl-policies.png
new file mode 100644
index 0000000..7cda6ae
Binary files /dev/null and b/assets/vault-acl-policies.png differ
diff --git a/assets/vault-audit-log-hashed.png b/assets/vault-audit-log-hashed.png
new file mode 100644
index 0000000..d3046f0
Binary files /dev/null and b/assets/vault-audit-log-hashed.png differ
diff --git a/docs/secrets-and-pki.md b/docs/secrets-and-pki.md
index 8ec2340..8e67197 100644
--- a/docs/secrets-and-pki.md
+++ b/docs/secrets-and-pki.md
@@ -85,5 +85,13 @@ Ranking these mattered more than just listing them: a reader (or an attacker) ne
 
 One policy per host, scoped to exactly what that host needs — no host's credentials can read another host's secrets. Every host-scoped policy follows the same shape: a shared grant for lightweight self-registration, plus a private grant with full read/write access only to that host's own namespace. Onboarding a new host copies this shape rather than reinventing it — and the shared grant does *not* automatically imply the private one, so both get verified before assuming a host is fully provisioned. This same "shared + private" pattern shows up again in [`docs/iac-pipeline.md`](iac-pipeline.md)'s tag-driven Ansible model — a deliberate consistency, not a coincidence.
 
+Beyond the host-scoped policies, a handful of narrowly-scoped read-only policies exist for specific, single-purpose needs — an Ansible role reading one sync secret at playbook-run time, Prometheus/Alloy reading Vault's own metrics endpoint, an auditor listing issued certificates across both PKI mounts. Each one grants exactly one path and nothing else — the same least-privilege instinct as the host policies, applied at a finer grain.
+
+![Vault's live ACL policy list — one policy per host, plus the narrowly-scoped read-only utility policies](../assets/vault-acl-policies.png)
+
+That "HMAC-hashed, not plaintext" claim in the table above isn't just a description — it's what a real audit log entry actually looks like:
+
+![A real Vault audit log entry: a KV read of the paperless-ngx secret, every value shown as hmac-sha256:... instead of plaintext](../assets/vault-audit-log-hashed.png)
+
 ---
 Related: [`docs/secret-distribution.md`](secret-distribution.md), [`docs/firewall-and-network.md`](firewall-and-network.md) · Stacks: [`stacks/identity-and-security/vaultwarden/`](../stacks/identity-and-security/vaultwarden/)