diff --git a/about/index.html b/about/index.html
index cb5aa0e..3c2a0bf 100644
--- a/about/index.html
+++ b/about/index.html
@@ -46,7 +46,7 @@
 
   <section id="s-streamers" class="hidden">
     <h2>Stream</h2>
-    <p class="lead">You are in <code>streamers</code>: you can publish under your own name. No passwords, no stream keys to keep.</p>
+    <p class="lead" data-group="streamers" data-yes="You are in <code>streamers</code>: you can publish under your own name. No passwords, no stream keys to keep." data-no="Admin view — you are <b>not</b> in <code>streamers</code>, so Go Live will refuse a token for you until you get the role."></p>
     <div class="links">
       <a class="card" href="/dock/"><b>OBS dock</b><span>title → Go Live; Dump tonight; manual setup</span></a>
       <a class="card" id="l-golive" href="#"><b>Go Live from the browser</b><span>Windows Chrome: share the game window, no OBS</span></a>
@@ -71,7 +71,7 @@
 
   <section id="s-editors" class="hidden">
     <h2>Edit</h2>
-    <p class="lead">You are in <code>editors</code>: read streams and clips, write finals.</p>
+    <p class="lead" data-group="editors" data-yes="You are in <code>editors</code>: read streams and clips, write finals." data-no="Admin view — you are not in <code>editors</code>; your copyparty rights come from <code>media-admins</code> instead."></p>
     <div class="links">
       <a class="card" href="/"><b>Browse &amp; download</b><span>copyparty — scrub in the browser, download originals, zip folders</span></a>
       <a class="card" href="/finals/"><b>Upload finals</b><span>the only folder editors can write to</span></a>
@@ -88,7 +88,7 @@
 
   <section id="s-mediaadmins" class="hidden">
     <h2>Media admin</h2>
-    <p class="lead">You are in <code>media-admins</code>: full rights on every folder, trash, Syncthing, dump anyone's night.</p>
+    <p class="lead" data-group="media-admins" data-yes="You are in <code>media-admins</code>: full rights on every folder, trash, Syncthing, dump anyone's night." data-no="Admin view — you are <b>not</b> in <code>media-admins</code>: copyparty will show you nothing and <code>/sync/</code> will 403 until you get the role."></p>
     <div class="links">
       <a class="card" href="/trash/"><b>Trash</b><span>dumped nights, purged after 3 days</span></a>
       <a class="card" href="/sync/"><b>Syncthing</b><span>device pairing, folder states</span></a>
@@ -105,7 +105,7 @@
 
   <section id="s-git" class="hidden">
     <h2>Code</h2>
-    <p class="lead">You are in <code>git-users</code>.</p>
+    <p class="lead" data-group="git-users" data-alt="git-admins" data-yes="You are in <code>git-users</code>." data-no="Admin view — you are <b>not</b> in <code>git-users</code>/<code>git-admins</code>: Authentik will refuse the Gitea login until you get the role."></p>
     <div class="links">
       <a class="card" id="l-git" href="#"><b>Gitea</b><span>repos, issues, CI — sign in with authentik</span></a>
     </div>
@@ -117,13 +117,13 @@
 
   <section id="s-bot" class="hidden">
     <h2>Bot</h2>
-    <p class="lead">You are in <code>bot-users</code>.</p>
+    <p class="lead" data-group="bot-users" data-yes="You are in <code>bot-users</code>." data-no="Admin view — you are <b>not</b> in <code>bot-users</code>: the bot host will 403 you until you get the role."></p>
     <div class="links"><a class="card" id="l-bot" href="#"><b>Bot web UI</b><span>Discord bot control panel</span></a></div>
   </section>
 
   <section id="s-admins" class="hidden">
     <h2>Administration</h2>
-    <p class="lead">You are in <code>admins</code> or <code>authentik Admins</code>.</p>
+    <p class="lead">You are in <code>admins</code> or <code>authentik Admins</code>. Sections you are not a member of are shown for reference and say so.</p>
     <div class="links">
       <a class="card" id="l-auth" href="#"><b>Authentik admin</b><span>users, groups, Discord source, policies</span></a>
       <a class="card" id="l-jfadmin" href="#"><b>Jellyfin dashboard</b><span>libraries, plugin, scheduled tasks</span></a>
@@ -162,6 +162,10 @@ $('dockurl').textContent = location.origin + '/dock/'; $('gitssh').textContent =
     show('s-git', has('git-users') || has('git-admins') || isAdmin);
     show('s-bot', has('bot-users') || isAdmin);
     show('s-admins', isAdmin);
+    document.querySelectorAll('p.lead[data-group]').forEach(p => {
+      const member = has(p.dataset.group) || (p.dataset.alt && has(p.dataset.alt));
+      p.innerHTML = member ? p.dataset.yes : p.dataset.no;
+    });
   } catch (e) { $('who').textContent = 'unknown (' + e.message + ')'; }
 })();
 </script>