diff --git a/codex-rs/execpolicy2/src/rule.rs b/codex-rs/execpolicy2/src/rule.rs
index 9e5c26f4b2..7cd3f04a69 100644
--- a/codex-rs/execpolicy2/src/rule.rs
+++ b/codex-rs/execpolicy2/src/rule.rs
@@ -29,6 +29,7 @@ impl PatternToken {
 }
 
 /// Prefix matcher for commands with support for alternative match tokens.
+/// First token is fixed since we key by the first token in policy.
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct PrefixPattern {
     pub first: String,