diff --git a/docs/offscale-plugin.md b/docs/offscale-plugin.md
index b0274eaf..082c4e56 100644
--- a/docs/offscale-plugin.md
+++ b/docs/offscale-plugin.md
@@ -491,13 +491,16 @@ export const manifest = {
     script: 'sidecar/index.ts',
   },
 
-  /** Permissions this plugin defines. `app` or `admin` only — see below. */
-  capabilities: [
+  // Named `permissions`, NOT `capabilities`. That word already means three different things here — the
+  // permission registry, the officer-items store, and the sidecar's routing keys — and a fourth would be
+  // one too many. `permissions` is accurate and free: the old table of that name went in 044aacf4.
+  permissions: [
     {
       key: 'offscale',
       label: 'Offscale',
       description: 'The tailnet: machines, routes and ACLs',
-      kind: 'admin',
+      /** Owner-only, or grantable to members. The whole distinction a plugin needs. */
+      ownerOnly: true,
     },
   ],