diff --git a/serverAppConfigs-docs/Infrastructure/Authentik.md b/serverAppConfigs-docs/Infrastructure/Authentik.md
index d4348bf..b132d02 100644
--- a/serverAppConfigs-docs/Infrastructure/Authentik.md
+++ b/serverAppConfigs-docs/Infrastructure/Authentik.md
@@ -449,8 +449,16 @@ access is decided entirely by GROUP MEMBERSHIP consumed downstream —
   `u.app_entitlements(app)`.
 - `jellyfin_users` / `jellyfin_admins` → Jellyfin via the LDAP outpost
   (filter `(memberOf=cn=jellyfin_users,ou=groups,dc=franksdank,dc=cloud)`).
-- `Non-Admin Users` = the plain-user marker group (precedents: alex,
-  qa-e2e).
+- `Non-Admin Users` = the plain-user marker group (precedents: qa-e2e, and
+  every human account).
+- **The human-user template** (ridley, kassie, alex — the last two created
+  2026-10-08): `username` + `<user>@franksdank.cloud` + display name +
+  `is_active=True` + the password set via `set_password`, membership in
+  `Non-Admin Users` + `jellyfin_users` + `openwebui_users`. `alex` was
+  recreated from scratch on 2026-10-08 into this shape (the old row had an
+  empty email and no `openwebui_users`; audit first — the row carried no MFA
+  device, token, entitlement, or proxy session, and events survive a user
+  delete because `Event.user` is a denormalized JSON field, not a FK).
 - EXCLUDE from a user-level account: `homepage-admins`, `jellyfin_admins`,
   `openwebui_admins`, `authentik Admins`, `authentik Read-only`.
 - Other user-category vhosts (SearXNG, Gitea, Calibre-Web, RomM, Copyparty,