diff --git a/README.md b/README.md
index 4dc21bc..927e49d 100644
--- a/README.md
+++ b/README.md
@@ -158,7 +158,8 @@ VMs only accept traffic from the Proxmox host (for Ansible) and the Nebula overl
 |-------|---------|
 | `admin` | Full access (your devices) |
 | `infrastructure` | Core services |
-| `ad` | Windows AD domain machines |
+| `ad` | Windows AD core services (DCs, CA) |
+| `workstations` | Domain-joined user machines (can only reach DCs) |
 | `projects` | Application workloads |
 | `games` | Isolated game servers |