diff --git a/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh b/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh
index 14f35a7b9d2..27ac6e494b3 100644
--- a/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh
+++ b/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh
@@ -8,6 +8,10 @@ status=$(cat /var/run/mdsd-ci/update.status)
 
 if [ "$status" = "add" ]; then
         echo "Status changed to $status."
+        # The Container Insights add-on supplies this config outside AgentBaker.
+        # Copying it trusts /var/run/mdsd-ci writers to configure host rsyslog.
+        # Deployment owners must restrict writers to components trusted for that role;
+        # hostPath write access alone does not imply equivalent node-level privilege.
         [ -f "/var/run/mdsd-ci/70-rsyslog-forward-mdsd-ci.conf" ] && cp /var/run/mdsd-ci/70-rsyslog-forward-mdsd-ci.conf /etc/rsyslog.d
 elif [ "$status" = "remove" ]; then
         echo "Status changed to $status."