From e57cf9181e850aeb30ecaed6f16db5186e6bcf1b Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Mon, 13 Jul 2026 10:39:33 -0700
Subject: [PATCH] Clarify oidc claim policy

---
 docs/installation/index.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/installation/index.md b/docs/installation/index.md
index 1905448cd..467b82bad 100644
--- a/docs/installation/index.md
+++ b/docs/installation/index.md
@@ -66,6 +66,10 @@ For OIDC login (overrides password login):
 - `HOMEPAGE_OIDC_CLIENT_SECRET`
 - Optional: `HOMEPAGE_OIDC_NAME` (display name), `HOMEPAGE_OIDC_SCOPE` (defaults to `openid email profile`)
 
+!!! warning
+
+    Homepage grants access to any identity that the configured OIDC provider authorizes for this client. Configure client assignments, groups, or access policies at the identity provider. Homepage does not apply additional claim-based authorization.
+
 All app pages and `/api` routes except `/api/healthcheck` will require a signed-in session. Static assets remain public.
 
 Configure your OIDC provider with the a callback URI like `https://homepage.example.com/api/auth/callback/homepage-oidc`.