diff --git a/README.md b/README.md
index 3eb71cb..511ef5e 100644
--- a/README.md
+++ b/README.md
@@ -304,9 +304,16 @@ chmod 600 authelia/secrets/*
 cp .env.example .env
 $EDITOR .env    # set DOMAIN, TZ; pin image versions if you want
 
-# 4) Uncomment access_control.rules in authelia/configuration.yml for the
-#    sites you want to gate. The domain is already templated -- just
-#    uncomment the right case block and choose one_factor or two_factor.
+# 4) For each site you added `import authelia` to in Caddy, uncomment the
+#    matching rule in authelia/configuration.yml under access_control.rules.
+#
+#    WHY: default_policy is 'deny'. If a domain reaches Authelia with no
+#    matching rule, Authelia returns 403 -- even to a logged-in user. The
+#    rule tells Authelia the domain is valid and what auth level to require.
+#
+#    Each rule is two lines -- just uncomment and pick one_factor or two_factor:
+#      - domain: 'cam.{{ env "DOMAIN" }}'
+#        policy: 'two_factor'
 $EDITOR authelia/configuration.yml
 
 # 5) Create your first user.