diff --git a/vendor/secure-exec/docs/content/docs/host-functions.mdx b/vendor/secure-exec/docs/content/docs/host-functions.mdx
index 8b2585b9..de61631b 100644
--- a/vendor/secure-exec/docs/content/docs/host-functions.mdx
+++ b/vendor/secure-exec/docs/content/docs/host-functions.mdx
@@ -24,6 +24,8 @@ Arguments from the guest are validated before your code runs.
 ## Call them from guest code
 
 Inside the VM each collection is a global object and each function is async.
+The globals exist in every guest Node process: inline code, spawned scripts,
+`node` run from the shell, and child processes of guest Node.
 
 <CodeSnippet file="secure-exec/examples/host-functions/src/index.ts" region="call" />
 
diff --git a/vendor/secure-exec/docs/content/docs/permissions.mdx b/vendor/secure-exec/docs/content/docs/permissions.mdx
index 10337e31..0f96f22c 100644
--- a/vendor/secure-exec/docs/content/docs/permissions.mdx
+++ b/vendor/secure-exec/docs/content/docs/permissions.mdx
@@ -26,7 +26,10 @@ scope as it was.
 ## Allow specific hosts
 
 A rule set denies by default and allows matching patterns. A host needs both a
-`dns://` pattern to resolve it and a `tcp://` pattern to connect to it.
+`dns://` pattern to resolve it and a `tcp://` pattern to connect to it. A rule
+set replaces the whole network scope, so add the VM-local `listen` and loopback
+rules from the [agentOS permissions reference](/agentos/docs/permissions#network)
+if guest code also runs a server. `network: "deny"` keeps them.
 
 <CodeSnippet file="secure-exec/examples/permissions/src/index.ts" region="scoped" />