commit - f3c9e061f375b34a3c2171dfbb3d2022c4873ded
commit + 44f8036e904cc038f2370d7f1736e16683f7d128
blob - d04dce33ba2a3e8ae9d438c12399eeea850be7c0
blob + c88fd19c4873d1a21e811a7bf9b973e94f2177e2
--- nsh.8
+++ nsh.8
@@ -4579,9 +4579,11 @@ Access to root privileges must be restricted to truste
 .Pp
 *NB End Security Warning
 .Pp
-Users can either start
+Users with regular shell access can start
 .Nm
-from another shell or be logged into an
+from another shell.
+.Pp
+Users will be logged into an
 .Nm
 session directly if the user account's login shell is set to
 .Nm
@@ -4604,8 +4606,10 @@ can be used with nsh arguments restricted to the
 .Fl e
 option.
 .Nm
-will attempt to obtain root privileges when privileged mode is entered,
-and with a line such as the following in
+will attempt to obtain root privileges when privileged mode is entered.
+To prevent abuse the user will be required to authenticate again with
+their own password.
+With a line such as the following in
 .Pa /etc/doas.conf
 this will succeed:
 .Bd -literal -offset indent