diff --git a/docs/approvals.md b/docs/approvals.md
index 70fe2779..bdf8a325 100644
--- a/docs/approvals.md
+++ b/docs/approvals.md
@@ -41,11 +41,13 @@ CLI) before it takes effect. What you'll see, and what to do with it:
   *agent* asking to schedule something, not for you doing it.
 
 Don't want to approve something? **Deny it** (`DENY` on the dashboard
-card, or `hivectl approvals deny <id>`) — nothing runs. The dashboard
-prompts for an optional reason, which lands directly in the submitting
-agent's inbox if you give one; the CLI denies without one. Denying is
-final: a denied approval can't be re-approved later, the agent has to
-submit a fresh one (a new PR, a new request).
+card, or `hivectl approvals deny <id>`) — nothing runs. Either way the
+submitting agent is always notified their request was denied; what's
+optional is only the reason text, which you can add on the dashboard's
+prompt (cancelling that prompt aborts the whole deny, not just the
+reason) but not from the CLI. Denying is final: a denied approval
+can't be re-approved later, the agent has to submit a fresh one (a new
+PR, a new request).
 
 Everything below this point is the implementation detail behind that
 flow.