dashboard: what its user may read

The dashboard's document box is read through the store, as its user
may, and the page is told only of changes where its user may read.

Auth plan M1 (the dashboard).

1 files changed, 2 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index cd11723..7a85c94 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -55,7 +55,8 @@ change to it counts on a node as soon as it has reached it.
 * **Protocol data** is in the store too, under `_continuum`: `read` and `write` on it
   as on any path.
 * **Looking at the node** (`/admin/stats`, `GET /peers`, the dashboard): any user with
-  a capability.
+  a capability. The dashboard's document box is read through the store, as the user
+  may; the page is told only of changes where its user may read.
 * **Remakes** (`/admin/remakes`): `read` on `_continuum/remakes` to look, `write` to
   propose or abort one. **Forgetting a peer** (`DELETE /peers/…`): `write` on
   `_continuum/forgotten`.