diff --git a/docs/permissions.md b/docs/permissions.md
new file mode 100644
index 0000000..85a1ef1
--- /dev/null
+++ b/docs/permissions.md
@@ -0,0 +1,5 @@
+# Permissions
+
+Permissions live in `src/lib/permissions.ts`. Routes declare required permissions, and the shell/page renderer can show permission-denied states.
+
+Initial roles include Super administrator and Read-only auditor. The roles screen exposes a detailed permission matrix covering every module and is ready to connect to a backend RBAC API.