diff --git a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardEndpointRouteBuilderExtensions.cs b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardEndpointRouteBuilderExtensions.cs
index e273726..b0e4c24 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardEndpointRouteBuilderExtensions.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardEndpointRouteBuilderExtensions.cs
@@ -104,9 +104,11 @@ public static class DashboardEndpointRouteBuilderExtensions
             .AllowAnonymous()
             .WithName("DashboardAccessDenied");
 
-        // SignalR hubs. Authorization is enforced on the hub class via
-        // [Authorize(Policy = HubClientsPolicy)] so the policy accepts either
-        // the dashboard cookie or a HubToken bearer.
+        // SignalR hubs. Authorization is enforced on the hub class via [Authorize], so both
+        // policies below accept either the dashboard cookie or a HubToken bearer. Snapshot and
+        // events use HubClientsPolicy; AlarmsHub uses AlarmsPolicy, which additionally requires a
+        // real authenticated dashboard role (SEC-40) — see AlarmsHub for why the alarm feed is
+        // gated harder than the session-scoped ones.
         endpoints.MapHub<DashboardSnapshotHub>("/hubs/snapshot");
         endpoints.MapHub<AlarmsHub>("/hubs/alarms");
         endpoints.MapHub<EventsHub>("/hubs/events");