diff --git a/packages/sdk/src/modules/ai-gateway.types.ts b/packages/sdk/src/modules/ai-gateway.types.ts
index 0585a97..4c0684e 100644
--- a/packages/sdk/src/modules/ai-gateway.types.ts
+++ b/packages/sdk/src/modules/ai-gateway.types.ts
@@ -5,9 +5,7 @@ export interface AiGatewayConnection {
   /** Base URL of the selected gateway provider. */
   baseURL: string;
   /**
-   * Bearer token that authenticates the request: the service-role token from
-   * `base44.asServiceRole.aiGateway`, or the signed-in user's token from
-   * `base44.aiGateway`. The gateway expects the service-role token.
+   * Bearer token that authenticates the request. The mode you call `connection()` from determines whose token it is.
    */
   token: string;
   /**
@@ -95,9 +93,15 @@ export interface AiGatewayModuleConfig {
  *
  * The mode determines which token `connection()` returns:
  *
- * - **Service role authentication** (`base44.asServiceRole.aiGateway`): Returns the app's service-role token. Use it server-side; the gateway rejects other calls with a `403` and the error code `ai_gateway_requires_service_role`. It also works with no signed-in user, such as from a scheduled automation.
+ * - **Service role authentication** (`base44.asServiceRole.aiGateway`): Returns the app's service-role token. Use it server-side. Calls from the browser or with a user's token get a `403` and the error code `ai_gateway_requires_service_role`. It also works when no user is signed in, such as from a scheduled automation.
  * - **User authentication** (`base44.aiGateway`): Returns the signed-in app user's token. The gateway accepts it only on apps shared privately or with your workspace.
  *
+ * The mode decides which token you get and whether the gateway accepts the call.
+ * It grants the model no extra reach, because the gateway runs a model and never
+ * touches your data. Access to your app's data comes from the `base44.entities`
+ * calls you write around the gateway call, so pick the mode for those on their
+ * own merits rather than matching this one.
+ *
  * ## Billing and limits
  *
  * Requests are billed to your app's credit quota, which is the same shared