Update

docs/KNOWN_LIMITATIONS.md

@@ -7,9 +7,11 @@ CRITICAL or HIGH release defect. Coverage and capability responses remain the
 runtime source of truth.
 
 - The access gate intentionally supports one environment-configured operator
-  account. There is no registration, password-recovery email, role model,
-  organisation management or multi-user database. Password rotation is an
-  operator configuration action followed by a runtime restart.
+  account. There is no registration, password-recovery email, organisation
+  management or multi-user database. Optional guest access is a short-lived,
+  read-only, demo-project-scoped role; it is not tenant isolation and must be
+  used only on a dedicated demo instance without private data. Operator
+  password rotation remains a configuration action followed by a restart.
 
 ## Source coverage
 
@@ -72,8 +74,8 @@ runtime source of truth.
 - Long AI/GIS work still uses the existing synchronous job abstraction rather
   than a distributed durable queue. Interrupted synchronous work is marked
   failed on restart and must be retried explicitly.
-- GeoIntel RC is a controlled single-operator deployment. Authentication,
-  multi-user authorization and tenant isolation are outside the frozen RC
-  scope.
+- GeoIntel remains a controlled single-operator product. The optional guest
+  demo adds bounded presentation access only; multi-user authorization and
+  tenant isolation remain outside the product scope.
 - Cleanup remains manual, dry-run-first and confirmation-gated. No automatic
   retention schedule is installed.