diff --git a/docs/DEPLOYMENT_OPERATOR_GUIDE.md b/docs/DEPLOYMENT_OPERATOR_GUIDE.md
index f00abad..1ea75d5 100644
--- a/docs/DEPLOYMENT_OPERATOR_GUIDE.md
+++ b/docs/DEPLOYMENT_OPERATOR_GUIDE.md
@@ -213,7 +213,7 @@ enforcement until Redis recovers.
 
 | Setting | Default | Notes |
 | --- | --- | --- |
-| `GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS` | `true` in dev/test, otherwise `false` | Deployment-wide decision. Set `true` only when connectors, mail, SMB, or object storage must reach internal addresses. |
+| `GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS` | `true` in dev/test, otherwise `false` | Deployment-wide decision. Set `true` only when pinned HTTP(S), DAV, SMTP, or IMAP transports must reach internal addresses. It does not enable an SDK transport that cannot pin every peer. |
 | `GOVOPLAN_CONNECTOR_MAX_STRUCTURED_RESPONSE_BYTES` | `16777216` (16 MiB) | Maximum buffered JSON, XML, iCalendar, vCard, catalog, and connector error response. |
 | `GOVOPLAN_CONNECTOR_MAX_FILE_TRANSFER_BYTES` | `536870912` (512 MiB) | Hard upper bound for a single remote file; module upload limits may be lower. |
 | `GOVOPLAN_CONNECTOR_SECRET_ENV_ALLOWLIST` | empty | Comma-separated exact environment names usable by deployment-owned connector profiles. Tenant/API-managed profiles cannot select process variables, even when a name is listed. |
@@ -226,12 +226,12 @@ origin.
 
 The urllib, HTTPX/httpcore, SMTP, and IMAP transports resolve, validate, and
 connect to the same approved address record while retaining the original host
-for HTTP Host, TLS SNI, and certificate verification. SMB uses an approved
-numeric connection target in public-only mode. The S3 SDK cannot provide the
-same peer and redirect guarantee, so S3 connector endpoints fail closed while
-application-enforced public-only egress is required. Production deployments
-should still enforce the same decision at their worker/container egress firewall
-or outbound proxy as a second boundary.
+for HTTP Host, TLS SNI, and certificate verification. Live SMB and S3 access
+fails closed in both public-only and private-network deployments: the current
+SDK transports cannot pin every initial and secondary peer or revalidate every
+SDK-managed redirect/referral. An explicit IP endpoint does not bypass this
+rule. Production deployments should still enforce the same decision at their
+worker/container egress firewall or outbound proxy as a second boundary.
 
 File connector TLS verification may be disabled only in dev/test. A custom CA
 bundle must be an existing regular file whose resolved absolute path is listed