diff --git a/skills/how-sausage-works/SKILL.md b/skills/how-sausage-works/SKILL.md
index c777133..6068868 100644
--- a/skills/how-sausage-works/SKILL.md
+++ b/skills/how-sausage-works/SKILL.md
@@ -22,4 +22,5 @@ Summarize the project, control preference, and task. Use remember only for durab
 Read integrate-sausage before proposals for specialization. Start the first authorized task through branch with its repo path.
 
 The world contains /bin programs. Agents write CLIs and servers inside one WASI sandbox.
-The host injects credentials. A 403 requests host approval. Secrets never enter the world.
+The host injects managed credentials. A 403 requests host approval. Managed secrets stay in the host.
+Provider API keys in /etc/sausage/config.yaml are the explicit exception.