diff --git a/codex-rs/core/config.schema.json b/codex-rs/core/config.schema.json
index 5eab764fc3..5ce39f4be5 100644
--- a/codex-rs/core/config.schema.json
+++ b/codex-rs/core/config.schema.json
@@ -642,6 +642,7 @@
           "type": "boolean"
         },
         "allow_unix_sockets": {
+          "description": "When `requirements.toml` sets `experimental_network.allow_unix_sockets`, values here may further narrow access but must stay within the managed socket allowlist (subset semantics).",
           "items": {
             "type": "string"
           },
@@ -651,6 +652,7 @@
           "type": "boolean"
         },
         "allowed_domains": {
+          "description": "When `requirements.toml` sets `experimental_network.allowed_domains`, values here may further narrow access but must stay within the managed allowlist (subset semantics).",
           "items": {
             "type": "string"
           },
@@ -663,6 +665,7 @@
           "type": "boolean"
         },
         "denied_domains": {
+          "description": "When `requirements.toml` sets `experimental_network.denied_domains`, managed entries are always enforced. Values here can add more denied domains but cannot remove the managed ones (floor semantics).",
           "items": {
             "type": "string"
           },