diff --git a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardGroupTagMapping.cs b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardGroupTagMapping.cs
index 84be574..7e3b750 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardGroupTagMapping.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardGroupTagMapping.cs
@@ -6,6 +6,9 @@ namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
 /// Sibling of <see cref="DashboardGroupRoleMapping"/> and deliberately follows
 /// the same group-matching rules (full DN first, leading-RDN fallback,
 /// case-insensitive) so operators write one kind of group key for both maps.
+/// Because the shared LDAP provider delivers groups already stripped to short
+/// RDN names, full-DN <c>GroupToTag</c> keys can never match — use short group
+/// names as keys (see the lookup comment in <see cref="MapGroupsToTags"/>).
 /// Tags gate dashboard event VISIBILITY only; they are never a data-access
 /// constraint.
 /// </summary>