diff --git a/docs/tools/hivectl-cli.md b/docs/tools/hivectl-cli.md
index d8a83d62..cb787d1b 100644
--- a/docs/tools/hivectl-cli.md
+++ b/docs/tools/hivectl-cli.md
@@ -497,7 +497,7 @@ Replaces the agent's whole override entry rather than merging into it: any limit
 
 Open an interactive Claude session inside this agent's container.
 
-A fresh session by default, or resume a prior one. Requires root and a running container.
+A fresh session by default, or resume a prior one. Requires root or `hive-admin` group membership, plus a running container.
 
 **Usage:** `hivectl agent choom [OPTIONS]`
 
diff --git a/docs/tools/hivectl.md b/docs/tools/hivectl.md
index 9ee1c99a..ab4b747a 100644
--- a/docs/tools/hivectl.md
+++ b/docs/tools/hivectl.md
@@ -201,10 +201,10 @@ they go into a systemd drop-in verbatim, and a typo there makes the
 unit fail to start.
 
 **Declarative, not incremental**: each invocation replaces the agent's
-whole entry. `set-limits sock --memory-max 8G` leaves `sock` with _only_
-a memory override, reverting any previously set CPU quota to the hive
-default. To avoid a forgotten flag silently wiping an override, hivectl
-rejects a bare `set-limits <name>` with no flags — clearing requires the
+whole entry. `hivectl agent sock set-limits --memory-max 8G` leaves `sock`
+with _only_ a memory override, reverting any previously set CPU quota to
+the hive default. To avoid a forgotten flag silently wiping an override,
+hivectl rejects `set-limits` with no flags at all — clearing requires the
 explicit `--reset`.
 
 The command rewrites the container's drop-in and reloads systemd, so
@@ -227,9 +227,9 @@ before you were added to `hive-admin` won't see it until you log back in
 It also needs the daemon socket, unlike the other exec-into-a-container
 paths: the "is this actually an agent?" pre-flight reads the agents root,
 which the daemon's user owns and which isn't group-readable, so the check
-is a `HostRequest` rather than a local `stat`. A rootless `choom` therefore
-tells you it needs root, instead of reporting a permission problem with
-the state dir.
+is a `HostRequest` rather than a local `stat`. An unprivileged `choom`
+therefore names the grant it wants, instead of reporting a permission
+problem with the state dir.
 
 ```bash
 hivectl agent iris choom                          # fresh blank Claude session in iris's container
diff --git a/docs/turn-loop/mcp.md b/docs/turn-loop/mcp.md
index 7a08806d..64152412 100644
--- a/docs/turn-loop/mcp.md
+++ b/docs/turn-loop/mcp.md
@@ -226,8 +226,8 @@ operator-driven `hivectl agent <name> choom` session — which passes neither `-
 nor `--allowedTools` — gets claude's built-in synchronous `Bash` tool
 (inline, human-approved). That sidesteps the async `mcp__bash__run`
 completion wake landing in the wrong session (the harness inbox) for a
-choom-started task; `choom` is an operator (root) action, so
-built-in shell there stays within the existing trust boundary. The bash MCP server
+choom-started task; `choom` is an operator action (root or `hive-admin`),
+so built-in shell there stays within the existing trust boundary. The bash MCP server
 (`run` / `status` / `kill`) uses `allowedTools = ["*"]` so all
 `mcp__bash__*` tools are always available regardless of tool groups.
 
diff --git a/hivectl/src/cli.rs b/hivectl/src/cli.rs
index 2cfeb8e1..25e8231e 100644
--- a/hivectl/src/cli.rs
+++ b/hivectl/src/cli.rs
@@ -544,7 +544,7 @@ pub enum AgentCmd {
     /// Open an interactive Claude session inside this agent's container.
     ///
     /// A fresh session by default, or resume a prior one. Requires root
-    /// and a running container.
+    /// or `hive-admin` group membership, plus a running container.
     Choom {
         /// Resume a prior claude session by its session id, passed
         /// through as `claude --resume <value>` (claude's `--continue`