diff --git a/SECURITY.md b/SECURITY.md
index 8646b7e2..cbb16dfe 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -23,6 +23,23 @@ If the AI client should never be able to reach the rest of your machine, that gu
 
 Terminal command execution is a first-class feature. Because it can launch arbitrary programs, path-based and command-based restrictions can be circumvented by design — for example via shell substitution, absolute paths, or invoking another interpreter. These controls are advisory: they make common mistakes less likely; they are not a boundary against a client that is actively trying to escape them.
 
+## Optional external policy gateway
+
+Deployments that need a policy decision for each operation can place an external
+policy gateway between the AI client and Desktop Commander. A gateway can
+normalize a tool call, apply file and command policy, request human approval,
+forward allowed calls, and write a redacted audit record.
+
+Gateway timeouts, errors, and missing policy decisions should fail closed: do
+not forward a call without an explicit allow decision or completed approval.
+
+This is an additional governance layer, not a sandbox. It can govern only calls
+that are routed through it; a client connected directly to Desktop Commander can
+bypass the gateway. Keep OS-level isolation in place when containment is required.
+
+Desktop Commander does not require or imply support for any particular gateway
+implementation.
+
 ## Recommended deployment for stronger isolation
 
 For any workload where the AI client must not access the wider machine, run Desktop Commander inside an isolated environment:
@@ -64,4 +81,4 @@ If you'd prefer not to disclose publicly, reach out via Discord to arrange priva
 
 ---
 
-*Last updated: July 2026*
\ No newline at end of file
+*Last updated: July 2026*