diff --git a/docs/awf-config-spec.md b/docs/awf-config-spec.md
index 6437c6030..fa09dd221 100644
--- a/docs/awf-config-spec.md
+++ b/docs/awf-config-spec.md
@@ -655,6 +655,15 @@ When `security.difcProxy.host` is set, `GITHUB_TOKEN` and `GH_TOKEN` MUST
 be excluded from the agent environment. These tokens SHALL be held
 exclusively by the external DIFC proxy.
 
+Under `--network-isolation`, the credential-bearing cli-proxy sidecar remains on
+`awf-net` only. When `security.difcProxy.host` is classified as external
+(`host.docker.internal`, an IP address outside `awf-net`'s subnet, or a dotted DNS name), AWF creates a separate,
+credential-free `cli-proxy-egress` relay that is the only CLI-proxy component
+dual-homed onto the external bridge; it forwards solely to the configured DIFC
+host and port and never receives `GITHUB_TOKEN` or `GH_TOKEN`. When the DIFC
+proxy is an attached sibling container already reachable on `awf-net`, no relay
+is created.
+
 ## 10. Effective Token Budget Enforcement
 
 *This section is normative.*