diff --git a/frontend/src/lib/components/flows/content/AgentEditorHost.svelte b/frontend/src/lib/components/flows/content/AgentEditorHost.svelte
index 572f1cbe87..b9521683b1 100644
--- a/frontend/src/lib/components/flows/content/AgentEditorHost.svelte
+++ b/frontend/src/lib/components/flows/content/AgentEditorHost.svelte
@@ -349,8 +349,8 @@
 		inputs?: Record<string, any>
 	): Promise<string | undefined> {
 		if (!agentModule) return undefined
-		// A view runs the deployed agent, which anyone who can read it may do; the editor previews
-		// the draft. Both run as the caller.
+		// A view runs the deployed agent as its on-behalf-of identity, which anyone who can read it
+		// may do; the editor previews the draft as the one editing it.
 		if (view && workspace) {
 			return await JobService.runAgent({
 				workspace,
@@ -443,6 +443,8 @@
 	 *  only report after the request. */
 	let pathError = $state('')
 
+	/** Who the next deploy makes the agent run as, as the "Permissioned as" line picked it. */
+
 	export function deploy(): Promise<boolean> {
 		if (pathError) {
 			sendUserToast(`Cannot deploy the agent: ${pathError}`, true)