diff --git a/docs/hq/licensing-and-entitlements.md b/docs/hq/licensing-and-entitlements.md
index bc5d40c..9dd77cb 100644
--- a/docs/hq/licensing-and-entitlements.md
+++ b/docs/hq/licensing-and-entitlements.md
@@ -40,20 +40,7 @@ Four features are enabled per instance rather than bundled into a tier:
 No tier includes them by default; you enable them on the instances that need
 them.
 
-## Entitlements: desired and granted
-
-Each instance has one entitlement row holding two configurations:
-
-|             | Meaning                      |
-| ----------- | ---------------------------- |
-| **Desired** | What you last asked for      |
-| **Granted** | What a payment has confirmed |
-
-Checkout is built from **desired**. A licence is only ever signed from
-**granted**. An abandoned checkout therefore leaves a desired that reached
-nothing and changed nothing.
-
-### Increases and reductions
+## Increases and reductions
 
 An increase takes effect when payment confirms, and the entitlement is promoted
 desired → granted.
diff --git a/docs/hq/people-and-roles.md b/docs/hq/people-and-roles.md
index d071be5..9623567 100644
--- a/docs/hq/people-and-roles.md
+++ b/docs/hq/people-and-roles.md
@@ -35,10 +35,11 @@ Their invitation link stays valid until they use it to set that password.
 
 ### Removing someone
 
-Removing them from the account removes their portal access. See below for what
-happens to their instance access.
+Removing them from the account removes their portal access.
 
-## Instance access
+It also removes their instance access immediately, and ends any session they have open.
+
+## Cloud instance access
 
 Granting access to a **cloud** instance creates a real account inside that
 instance, marked as managed by Vantage HQ.
@@ -53,39 +54,12 @@ They then sign in at the instance itself, and that keeps working whether or not
 Vantage HQ is reachable. Revoking removes the account outright, so access ends
 immediately.
 
-### Granting
+### Granting access and roles
 
-On an instance record, **Members → Add**, choose an account member and an
+On an instance record, **Members → Add**, choose the HQ account member and an
 instance role (`owner`, `admin`, `member`).
 
 One person gets one account per instance, so granting twice is refused rather
 than quietly creating a second.
 
-### Roles inside an instance
-
-Independent of the account role. Someone can be an account `member` and an
-instance `owner`, or the reverse.
-
-### Revoking
-
-Removes their access immediately, and ends any session they have open.
-
-:::warning Self-hosted instances cannot be granted from HQ
-Vantage HQ cannot add or remove people in a self-hosted install. Manage them in
-the install itself, at **Settings → Access**.
-:::
-
-## Passwords
-
-One Vantage HQ password covers you and every cloud instance you have been given
-access to. Change it in the portal and it changes everywhere, within about 15
-minutes at worst if an instance is briefly unreachable.
-
-Those people cannot change that password inside an instance, so there is only
-ever one place it is set.
-
-:::warning HQ-managed users are read-only in the instance
-Changing the role of, or removing, someone managed by Vantage HQ has to be done
-from the portal. Inside the instance those rows are read-only, with a link back
-here.
-:::
+These roles are independant of HQ account roles.