diff --git a/README.md b/README.md
index ad19ceb..6a70641 100644
--- a/README.md
+++ b/README.md
@@ -431,8 +431,8 @@ in a single walk.
 `verify_chain` is the integrity check that backs the audit promise —
 it is intentionally cheap (one indexed walk) and intentionally
 side-effect-free so a scheduler can run it on a cron and alert on any
-non-`{ok: true}` result. Chain verification is **not** access-gated
-beyond the same `127.0.0.1` bind the rest of the API uses; for a
+non-`{ok: true}` result. Chain verification is gated by the standard
+`matrix_gate` dependency (admin role for the `/verify` subpath); for a
 hostile multi-operator deployment, wrap the route in your reverse proxy.
 
 ## Encryption at Rest