diff --git a/docs/web-ui/dashboard.md b/docs/web-ui/dashboard.md
index 92116fe9..03278ba9 100644
--- a/docs/web-ui/dashboard.md
+++ b/docs/web-ui/dashboard.md
@@ -119,6 +119,57 @@ age + claude-creds badge). Two actions: `⊕ R3V1V3` (queues a
 Spawn approval; existing state is reused), `PURG3` (wipes
 state + applied dirs; `POST /purge-tombstone/{name}`).
 
+## P3RM1SS10NS tab
+
+Per-agent permission configuration. Two sections, each rendered as a
+column-driven checkbox matrix: rows are agents, columns are the
+permission names fetched from the backend. The column list is
+authoritative — adding a new tool-group or capability to the backend
+requires no UI change; the new column appears automatically.
+
+Fetches fire on tab activation (not page-load) to avoid unnecessary
+work when the operator never visits this tab.
+
+**C4P4B1L1T13S** — per-agent capability grants. Capabilities unlock
+gated MCP tools and system-level access beyond the default agent
+surface. A saving POST queues a rebuild for the affected agent so the
+new `HIVE_CAPABILITIES` env var takes effect in the next session.
+
+The current capabilities are:
+
+| Name | Effect |
+|------|--------|
+| `manage_root_agent` | allows the `set_status` / lifecycle tools on the root manager |
+| `read_host_journal` | unlocks `get_host_journal` to read journald from inside a container |
+| `query_agent_state` | allows `get_loose_ends(agent: "<name>")` calls targeting other agents |
+
+Each row is one agent. Columns are the capability names returned by
+`GET /api/capabilities` as `caps: Vec<String>`. Checking or unchecking
+boxes changes only the in-browser state; the `S4V3` button on the
+right edge POSTs the full capability set for that agent to
+`POST /api/capabilities/{agent}` as `{ caps: ["name", …] }` and
+queues a rebuild. Absent agents in the assignment map have no extra
+capabilities.
+
+**T00L GR0UPS** — per-agent tool-group permissions. Tool groups are
+named buckets of MCP tools; each agent starts with a role default
+(agents: `messaging`, `meta`, `inbox`, `execution`; manager: all
+groups). Checking / unchecking and saving changes which groups are
+active for the agent. Backed by `GET /api/tool-groups` (columns) and
+`POST /api/tool-groups/{agent}` (save). A rebuild is queued after
+each save so `HIVE_TOOL_GROUPS` takes effect.
+
+The current tool groups are: `messaging`, `meta`, `inbox`, `lifecycle`,
+`approvals`, `scheduling`, `diagnostics`, `execution`. All listed in
+`ToolGroup::ALL` in `hive-sh4re`.
+
+Both tables share the same visual shape: `.cap-table-wrap` /
+`.tg-table-wrap` outer scroll container, `thead` with a label column
+(`.cap-agent-col` / `.tg-agent-col`) + one column per permission
+(`.cap-col` / `.tg-group-col`) + a save column (`.cap-save-col` /
+`.tg-save-col`). Each tbody row is one agent: a name cell, checkbox
+cells, and the `S4V3` button.
+
 ## SCH3DUL3S tab
 
 Anything that fires at a future time. Operator-set schedules
@@ -682,6 +733,26 @@ that's a browser-level decision, not ours.
 - `POST /cancel-reminder/{id}` — hard-delete a pending reminder.
 - `POST /retry-reminder/{id}` — re-arm a reminder whose delivery
   failed (clears the failure state so the scheduler retries).
+- `GET /api/tool-groups` — returns `{ groups: Vec<String>,
+  assignments: BTreeMap<String, Vec<String>> }`. `groups` is the
+  ordered list of all known tool-group names (drives the column
+  headers in the P3RM1SS10NS tab); `assignments` is the per-agent
+  override map (absent agents use the role default).
+- `POST /api/tool-groups/{agent}` — body `{ groups: ["name", …] }`.
+  Writes the tool-group set for `{agent}` to
+  `/var/lib/hyperhive/meta/tool-groups.json` and queues a rebuild so
+  `HIVE_TOOL_GROUPS` takes effect. Agent name validated;
+  `guard_agent_name` applied.
+- `GET /api/capabilities` — returns `{ caps: Vec<String>,
+  assignments: BTreeMap<String, Vec<String>> }`. `caps` is the
+  ordered list of all known capability names; `assignments` is the
+  per-agent grant map (absent agents have no extra capabilities).
+- `POST /api/capabilities/{agent}` — body `{ caps: ["name", …] }`.
+  Writes the capability set for `{agent}` to
+  `/var/lib/hyperhive/meta/capabilities.json` and queues a rebuild so
+  `HIVE_CAPABILITIES` takes effect. Agent name validated;
+  unknown capability strings are rejected (400). `guard_agent_name`
+  applied.
 - `GET /api/schedules` — list all schedules (active and
   recently cancelled) for the SYST3M scheduled-prompts panel.
 - `POST /api/schedules` — operator-direct schedule create: