diff --git a/.env.example b/.env.example
index 17f5cae1..6c73702a 100644
--- a/.env.example
+++ b/.env.example
@@ -7,14 +7,14 @@ MAX_UPLOAD_MB=500
 CORS_ORIGINS=http://localhost:1202,http://127.0.0.1:1202
 
 # Optional single-operator access gate. Store only a PBKDF2-SHA256 hash and
-# a unique 32+ character signing secret. Guest access is enabled by default
-# whenever this gate is active; disable it explicitly on non-demo instances.
+# a unique 32+ character signing secret. Guest access is demo-only and opt-in;
+# enable it only on a dedicated demo instance without private/operational data.
 GEOINTEL_AUTH_ENABLED=false
 GEOINTEL_AUTH_USERNAME=
 GEOINTEL_AUTH_PASSWORD_HASH=
 GEOINTEL_AUTH_SESSION_SECRET=
 GEOINTEL_AUTH_SESSION_TTL_SECONDS=43200
-GEOINTEL_GUEST_ACCESS_ENABLED=true
+GEOINTEL_GUEST_ACCESS_ENABLED=false
 GEOINTEL_GUEST_DISPLAY_NAME=Gast
 GEOINTEL_GUEST_SESSION_TTL_SECONDS=7200
 ORTHOPHOTO_ENABLED=true
@@ -118,9 +118,10 @@ YOLO_MODEL_ID=yolo-configured
 YOLO_MODEL_DISPLAY_NAME=Configured YOLO detector
 YOLO_MODEL_VERSION=
 YOLO_MODEL_CLASSES=building
-YOLO_ENFORCE_VALIDATION_SCOPE=false
-# Required when scope enforcement is enabled. The manifest is bound to exact
-# model bytes and contains the allowed EPSG:4326 validation geometry.
+YOLO_ENFORCE_VALIDATION_SCOPE=true
+# Required for configured YOLO inference when scope enforcement is enabled.
+# Missing/invalid evidence keeps the GIS app online but makes YOLO unavailable.
+# The manifest is bound to exact model bytes and allowed EPSG:4326 geometry.
 YOLO_VALIDATION_SCOPE_MANIFEST_PATH=
 YOLO_VALIDATION_SCOPE_MANIFEST_SHA256=
 # Deprecated display metadata; never used as an inference authorization gate.