diff --git a/README.md b/README.md
index 9bf2cc2..6b7bcf7 100644
--- a/README.md
+++ b/README.md
@@ -43,12 +43,12 @@ flowchart LR
 
     HUB{{"HUB<br/>hear - understand - check - route - answer"}}
 
-    subgraph OUT["Destinations"]
+    subgraph OUT["Peers and services<br/>(the Hub is not a destination)"]
         HA["Home Assistant"]
         SPK["Speakers<br/>Jervis TTS"]
-        NET["Internet control"]
+        NET["Internet control<br/>parental limits"]
         ART["Artemis<br/>phone screen"]
-        PC["Paperclip<br/>slow jobs"]
+        PC["Paperclip<br/>work bench"]
         WEB["Web search"]
         APP["Apprise / NTFY"]
     end
@@ -60,11 +60,12 @@ flowchart LR
     ADMIN --> HUB
     HUB --> HA
     HUB --> SPK
-    HUB --> NET
     HUB --> ART
-    HUB --> PC
     HUB --> WEB
     HUB --> APP
+    HUB -- "ask only (query)" --> NET
+    HUB -- "slow job (approved)" --> PC
+    ADMIN -- "control + tap to approve" --> NET
     PC -. result .-> HUB
 ```
 
diff --git a/docs/hub-architecture.mmd b/docs/hub-architecture.mmd
index 7dfc659..48c771d 100644
--- a/docs/hub-architecture.mmd
+++ b/docs/hub-architecture.mmd
@@ -9,12 +9,12 @@ flowchart LR
 
     HUB{{"HUB<br/>hear - understand - check - route - answer"}}
 
-    subgraph OUT["Destinations"]
+    subgraph OUT["Peers and services<br/>(the Hub is not a destination)"]
         HA["Home Assistant"]
         SPK["Speakers<br/>Jervis TTS"]
-        NET["Internet control"]
+        NET["Internet control<br/>parental limits"]
         ART["Artemis<br/>phone screen"]
-        PC["Paperclip<br/>slow jobs"]
+        PC["Paperclip<br/>work bench"]
         WEB["Web search"]
         APP["Apprise / NTFY"]
     end
@@ -26,11 +26,12 @@ flowchart LR
     ADMIN --> HUB
     HUB --> HA
     HUB --> SPK
-    HUB --> NET
     HUB --> ART
-    HUB --> PC
     HUB --> WEB
     HUB --> APP
+    HUB -- "ask only (query)" --> NET
+    HUB -- "slow job (approved)" --> PC
+    ADMIN -- "control + tap to approve" --> NET
     PC -. result .-> HUB
 
     click HUB "https://maps.lab.audasmedia.com.au/central_ai_llm_master/docs/" "View Archify Map"
diff --git a/docs/outline/01-system-overview.md b/docs/outline/01-system-overview.md
index 08357b3..5f6f2aa 100644
--- a/docs/outline/01-system-overview.md
+++ b/docs/outline/01-system-overview.md
@@ -37,6 +37,9 @@ Nothing here is ownership. These are directions of talk.
 - dsh chat — per-person chat.
 - Console portal — web dashboard.
 
+The admin app is also the trusted door. It calls a high-consequence control
+service directly, not through the Hub.
+
 ## Peers and Destinations
 
 Every other project is a peer. Each has its own folder, repo, port, and