diff --git a/docs/turn-loop.md b/docs/turn-loop.md
index 3ec1bd0a..e556d8aa 100644
--- a/docs/turn-loop.md
+++ b/docs/turn-loop.md
@@ -574,8 +574,10 @@ status hint moved to the wake prompt + UI header.
 ### Tool whitelist (`mcp::ALLOWED_BUILTIN_TOOLS`)
 
 - Allowed built-ins: `Edit`, `Glob`, `Grep`, `Read`, `Write`.
+- Capability-gated built-ins: `WebFetch`, `WebSearch` (added when the
+  `web_tools` capability is granted — see P3RM1SS10NS tab).
 - Denied by omission or `claude-settings.json` deny list: `Bash`,
-  `WebFetch`, `WebSearch`, `Task`, `NotebookEdit`, `TodoWrite`.
+  `Task`, `NotebookEdit`, `TodoWrite`.
 - Allowed MCP tools: as listed above per flavor.
 
 `Bash` is disallowed — shell execution goes through
@@ -583,3 +585,6 @@ status hint moved to the wake prompt + UI header.
 task-id tracking) instead of an interactive shell. The `bash_run` /
 `bash_status` MCP tools are always in the `--allowedTools` list.
 
+`WebFetch` / `WebSearch` are off by default; grant the `web_tools`
+capability in the P3RM1SS10NS tab and rebuild the agent to enable them.
+
diff --git a/docs/web-ui/dashboard.md b/docs/web-ui/dashboard.md
index 99aea322..b3f02c1a 100644
--- a/docs/web-ui/dashboard.md
+++ b/docs/web-ui/dashboard.md
@@ -142,6 +142,7 @@ The current capabilities are:
 | `manage_root_agent` | allows the `set_status` / lifecycle tools on the root manager |
 | `read_host_journal` | unlocks `get_host_journal` to read journald from inside a container |
 | `query_agent_state` | allows `get_loose_ends(agent: "<name>")` calls targeting other agents |
+| `web_tools` | adds Claude's built-in `WebFetch` (fetch a URL) and `WebSearch` (web search) to the agent's `--tools` list; off by default |
 
 Each row is one agent. Columns are the capability names returned by
 `GET /api/capabilities` as `caps: Vec<String>`. Checking or unchecking