From 327bcb22e255f8265021e472c6e7071f5e0dd196 Mon Sep 17 00:00:00 2001
From: Alexandre <44178713+alexbelgium@users.noreply.github.com>
Date: Thu, 23 Jul 2026 13:29:49 +0200
Subject: [PATCH] docs: clarify AI workflow authorization

---
 .github/ai/README.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/ai/README.md b/.github/ai/README.md
index e6702d07a7..23600a6a81 100644
--- a/.github/ai/README.md
+++ b/.github/ai/README.md
@@ -21,7 +21,9 @@ maintainer.
    pull request, and posts the root-cause report and pull-request URL.
 
 The validator independently rejects new top-level add-on directories and Codex
-never merges pull requests.
+never merges pull requests. The Codex Action keeps its default authorization,
+so only users with repository write access can trigger it; external issue
+authors cannot run it merely by opening an issue.
 
 ## Required secret