diff --git a/README.md b/README.md
index ab99590..0b0c493 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@ Heuristics run with no API key. An optional AI provider in Settings is a second
 2. Unzip it.
 3. Chrome → `chrome://extensions` → enable **Developer mode**.
 4. **Load unpacked** → select the unzipped folder.
-5. Open a new tab. Declare your intent. → set default policy → **Lock in** an intent.
+5. Open a new tab and follow [First run](#first-run).
 
 From source: clone this repo, load the repo folder unpacked, then `npm test`.
 
@@ -34,6 +34,16 @@ AI providers are not part of setup. Add one in **Settings** if you want a second
 - No habit dashboard or rewards
 - No Chrome Web Store listing yet (use the GitHub Release zip)
 
+## Permissions
+
+| Permission | Why |
+|------------|-----|
+| `storage` | Session, policy, settings and history stay in `chrome.storage` on this device; the optional AI key lives in session storage only |
+| `tabs`, `tabGroups` | Read tab URLs to check them against your intent, and replace a tab with the lock page when the content script cannot run. `tabGroups` puts the session's tab in a group |
+| `idle` | Detect when you are idle or the screen is locked so away time is not counted |
+| `alarms` | Session time-budget expiry and hourly pruning of old history and diagnostics |
+| Host access (`http://*/*`, `https://*/*`) | Inject the in-page lock overlay and dwell tracker on the pages you visit. Only origins are stored, never page text or titles |
+
 ## Privacy
 
 See [docs/privacy-policy.md](docs/privacy-policy.md). Optional remote LLM providers receive minimized intent and origin-only context when you configure a key.
@@ -262,10 +272,10 @@ Key `chrome.storage.local` entries:
 ### Testing
 
 ```bash
-npm test                                        # all unit tests (358)
-npm run verify:static                           # static/runtime/release checks (74)
+npm test                                        # all unit tests
+npm run verify:static                           # static/runtime/release checks
 node --test tests/heuristic-policy.test.mjs     # one suite, e.g. the policy engine
-npx playwright test                             # real-Chromium journeys + lifecycle (5)
+npx playwright test                             # real-Chromium journeys + lifecycle (needs Playwright)
 ```
 
 Unit tests use Node's built-in `node:test` + `assert/strict`, with no dependencies. The browser suite loads the unpacked extension in Chromium and covers two user journeys plus lifecycle cases: a real service-worker restart (lock and paused timer survive), the same URL in two tabs, and a real one-minute budget expiry. CI runs all three on every push and pull request.