diff --git a/docs/trust-boundary/security.md b/docs/trust-boundary/security.md
index 790aadd6..ef6c7a75 100644
--- a/docs/trust-boundary/security.md
+++ b/docs/trust-boundary/security.md
@@ -45,25 +45,25 @@ matrix **identities** — the public handles (`name`, `user_id` `@user:server`,
 peers can find and address one another on a shared matrix instance. Only the
 public handle crosses that boundary; the token never does.
 
-### The swarm secret store is not a boundary between hives
+### The swarm secret store isn't a boundary between hives
 
 A hive reads its agents' credentials out of the swarm's secret store with its
 own certificate. **Every hive's policy grants read on every agent's
 credentials**, not only on the agents it hosts — so a compromised hive can read
 the matrix token of an agent running on a different hive.
 
-That is deliberate and it is the interim state, not the intent. An agent's
-credential path does not name the hive hosting it (agents move between hives),
+That's deliberate and it's the interim state, not the intent. An agent's
+credential path doesn't name the hive hosting it (agents move between hives),
 so a per-hive grant has to be an enumeration the controller re-emits whenever
 the roster changes — and an enumeration that can drift or land out of order
-advertises a boundary it does not actually hold. A wide grant that says what it
+advertises a boundary it doesn't actually hold. A wide grant that says what it
 is beats a narrow one that only looks narrow.
 
-What still holds: the grant is **read-only** (a hive cannot write an agent's
-credential, so it cannot hand itself an agent's identity), and it is scoped to
+What still holds: the grant is **read-only** (a hive can't write an agent's
+credential, so it can't hand itself an agent's identity), and it's scoped to
 the agent-credential prefix — nothing else in the store is reachable with it.
 
-Narrowing it is tracked in **#4137**, with the two candidate directions: scope
+**#4137** tracks narrowing it, with the two candidate directions: scope
 the grant per hive (and pay for the re-emission), or give each agent container
 its own store identity so credentials never pass through a hive at all.