diff --git a/nix/module-eval/name-guards.nix b/nix/module-eval/name-guards.nix
index d5e42353..e4aa1a87 100644
--- a/nix/module-eval/name-guards.nix
+++ b/nix/module-eval/name-guards.nix
@@ -226,7 +226,7 @@ let
     }
     {
       # The substring guard has to work with the collector off too.
-      # `h1-agent` mints exactly the client id hive `h1`'s agents present.
+      # `h1-agent` would give the hive a client id the responder refuses.
       name = "a hive name containing a composed-identifier word is refused, with the collector off";
       ok = fragmentGuardFired hiveNameWithComposedWord;
     }
diff --git a/nix/reserved-hive-fragments.nix b/nix/reserved-hive-fragments.nix
index e418a01f..c2dd8b02 100644
--- a/nix/reserved-hive-fragments.nix
+++ b/nix/reserved-hive-fragments.nix
@@ -10,7 +10,7 @@
   # auth-callout responder strips to decide which hive a connection is.
   "hive"
   # `hive-<name>-agent` — an id the queue's responder refuses. A hive named
-  # `foo-agent` would mint exactly that id for itself.
+  # `foo-agent` would get a client id the responder refuses.
   "agent"
   # Also an exact-match entry next door, for the collector's `<kind>/<owner>`
   # components. Here because it is the word this swarm composes identifiers
diff --git a/swarm-nats-auth/src/policy.rs b/swarm-nats-auth/src/policy.rs
index 2cb41226..c193f2c9 100644
--- a/swarm-nats-auth/src/policy.rs
+++ b/swarm-nats-auth/src/policy.rs
@@ -444,16 +444,13 @@ impl Policy {
     /// suffix stripped as well, so `hive-foo-agent` answers `foo`. Two more on
     /// top:
     ///
-    /// - The agent client is minted per **hive**, so this answers *whose
-    ///   agents*, never *which agent*. Two agents on one hive are
-    ///   indistinguishable here — not a gap in the parsing but the identity
-    ///   itself, which does not carry the agent.
-    /// - A hive genuinely named `foo-agent` mints `hive-foo-agent` and is
-    ///   therefore **indistinguishable from hive `foo`'s agents** right here.
-    ///   Unguardable from inside this responder, which has no roster (see
-    ///   [`Self::hive_name`]) — `swarm-authelia.nix` asserts it at eval, where
-    ///   the roster is known, so the deployment fails to build rather than
-    ///   minting two principals with one id.
+    /// - The id carries the hive and never the agent, so this answers *whose
+    ///   agents*, never *which agent*.
+    /// - A hive genuinely named `foo-agent` has the client id `hive-foo-agent`,
+    ///   which this reads as hive `foo`'s agent client, an id the responder
+    ///   refuses. Unguardable from inside this responder, which has no roster
+    ///   (see [`Self::hive_name`]) — `swarm-authelia.nix` asserts it at eval,
+    ///   where the roster is known, so the deployment fails to build.
     fn agent_hive<'a>(&self, client_id: &'a str) -> Option<&'a str> {
         client_id
             .strip_prefix(&self.hive_prefix)?