diff --git a/README.md b/README.md
index 7d773d1..cf6f56f 100644
--- a/README.md
+++ b/README.md
@@ -135,6 +135,8 @@ Mistborn enables remote desktop access via the Apache Guacamole extra service, w
 
 ![Guacamole Recent Connections](https://gitlab.com/cyber5k/public/-/raw/master/graphics/guacamole_connections.png)
 
+Guacamole implements its own users and groups access controls to manage access to individual desktops. All Mistborn users must be authenticated with Mistborn (via Wireguard only or MFA) to access the Guacamole interface.
+
 # Client to client communication
 By default direct communication between network clients is blocked. Mistborn clients can all talk to Mistborn and communicate via shared services (Jitsi, Nextcloud, etc). Direct client to client communication can be enabled via the "client-to-client" toggle.