diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2db39c35..534ff147 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,8 +42,14 @@ jobs:
               - 'backend/**'
               - 'connectors/**'
               - '.github/workflows/ci.yml'
+            # website/** is included because the guards that protect website/ live in the
+            # frontend suite (src/config/__tests__/website*.test.ts + docs.test.ts): the CSP
+            # script hash, cross-chapter nav/footer consistency, security.txt expiry, and the
+            # docs anchor contract. Without it a website-only PR skips the frontend job and
+            # ships past every one of them.
             frontend:
               - 'frontend/**'
+              - 'website/**'
               - '.github/workflows/ci.yml'
             helm:
               - 'charts/**'
diff --git a/website/README.md b/website/README.md
index f6049618..fbbf0412 100644
--- a/website/README.md
+++ b/website/README.md
@@ -33,6 +33,8 @@ the right.
 | Source of truth | Website section |
 |---|---|
 | [`README.md`](../README.md) (pitch, quick start) | Hero, Install tabs, terminal preview |
+| [`README.md`](../README.md), [`docs/01-overview.md`](../docs/01-overview.md), [`docs/13-mcp.md`](../docs/13-mcp.md), [`LICENSE.md`](../LICENSE.md) — plus the same engine list as the Connectors section | **"Common questions" section** (homepage, `#questions`) — six question-form headings with short, self-contained answers (what a database access proxy is, supported engines, data handling, VPN/bastion contrast, licence, AI-agent/MCP access). Question-form headings and standalone answers are what AI-search surfaces extract, so keep each answer readable with **no surrounding context**. Deliberately **no `FAQPage` schema** — Google retired FAQ rich results for all sites in May 2026. Also linked from [`llms.txt`](llms.txt) |
+| (no upstream — derived from the chapter it opens) | The question-form `<h3>` + answer block at the top of each [`docs/`](docs/) chapter, and the `Last updated <time>` line under every docs `<h1>`. The `datetime` attribute must stay equal to that page's JSON-LD `dateModified` **and** its [`sitemap.xml`](sitemap.xml) `<lastmod>` — move all three together |
 | [`docs/02-architecture.md`](../docs/02-architecture.md) | Architecture diagram |
 | [`backend/pom.xml`](../backend/pom.xml), [`frontend/package.json`](../frontend/package.json) | Architecture callouts, From-source toolchain versions in Install tab |
 | (no upstream — copy lives in the website) | System requirements panel sizing tiers (Evaluation / Production) |
diff --git a/website/docs/configuration/ai/index.html b/website/docs/configuration/ai/index.html
index 909d0b9b..54a20d9d 100644
--- a/website/docs/configuration/ai/index.html
+++ b/website/docs/configuration/ai/index.html
@@ -60,6 +60,8 @@
       "name": "AI analysis, RAG & anomaly detection \u2014 AccessFlow docs",
       "description": "Configure AI providers for AccessFlow query risk analysis, add a RAG knowledge base, trace prompts with Langfuse, and enable behavioural anomaly detection.",
       "inLanguage": "en",
+      "articleSection": "Configuration",
+      "datePublished": "2026-04-01",
       "dateModified": "2026-08-03",
       "url": "https://accessflow.bablsoft.com/docs/configuration/ai/",
       "mainEntityOfPage": "https://accessflow.bablsoft.com/docs/configuration/ai/",
@@ -105,7 +107,13 @@
       "@id": "https://github.com/bablsoft#org",
       "name": "bablsoft",
       "url": "https://github.com/bablsoft",
-      "logo": "https://accessflow.bablsoft.com/favicon.svg"
+      "logo": "https://accessflow.bablsoft.com/favicon.svg",
+      "description": "bablsoft builds AccessFlow, an open-source access proxy that puts AI review, human approval workflows and a tamper-evident audit log in front of databases, cloud data warehouses and outbound APIs.",
+      "foundingDate": "2026-04",
+      "sameAs": [
+        "https://github.com/bablsoft",
+        "https://github.com/bablsoft/accessflow"
+      ]
     }
   ]
 }
@@ -132,8 +140,9 @@
         <a href="/#how">How it works</a>
         <a href="/#use-cases">Use cases</a>
         <a href="/#install">Install</a>
+        <a href="/#questions">Questions</a>
         <a href="/#roadmap">Roadmap</a>
-        <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+        <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
       </nav>
       <details class="nav-mobile">
         <summary aria-label="Open navigation menu">
@@ -147,8 +156,9 @@
           <a href="/#how">How it works</a>
           <a href="/#use-cases">Use cases</a>
           <a href="/#install">Install</a>
+          <a href="/#questions">Questions</a>
           <a href="/#roadmap">Roadmap</a>
-          <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+          <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
           <div class="nav-mobile-divider" aria-hidden="true"></div>
           <button class="theme-toggle nav-mobile-theme" type="button" data-theme-toggle aria-label="Switch to light theme" aria-pressed="false">
             <svg class="theme-toggle-icon theme-toggle-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" width="16" height="16" aria-hidden="true">
@@ -220,6 +230,7 @@
         <header class="docs-hero">
           <span class="eyebrow">Documentation</span>
           <h1>AI configuration.</h1>
+          <p class="docs-updated">Last updated <time datetime="2026-08-03">3 August 2026</time></p>
         </header>
 
 <section class="docs-section">
@@ -230,6 +241,10 @@ <h2 id="cfg-ai">AI configurations</h2>
             data-egress policy; AccessFlow then scores every submitted query and, where enabled, drafts
             queries from plain-language prompts. It ships adapters for five providers — pick one:
           </p>
+          <h3>Which AI providers does AccessFlow support?</h3>
+          <p>
+            Anthropic, OpenAI, Ollama, Hugging Face, and any OpenAI-compatible endpoint. You configure one provider per organization and supply its API key, base URL, and model. Ollama keeps every prompt on your own infrastructure, so no query text leaves the network — the usual choice when data-egress policy forbids a hosted model.
+          </p>
           <ul>
             <li><strong>Anthropic</strong> — default model <code>claude-sonnet-4-20250514</code>.</li>
             <li><strong>OpenAI</strong> — default model <code>gpt-4o</code>.</li>
@@ -496,13 +511,14 @@ <h3>Product</h3>
             <li><a href="/#how">How it works</a></li>
             <li><a href="/#use-cases">Use cases</a></li>
             <li><a href="/#install">Quick start</a></li>
+            <li><a href="/#questions">Questions</a></li>
             <li><a href="/#roadmap">Roadmap</a></li>
           </ul>
         </div>
         <div class="footer-col">
           <h3>Docs</h3>
           <ul>
-            <li><a href="index.html">User documentation</a></li>
+            <li><a href="/docs/">User documentation</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/02-architecture.md">Architecture</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/04-api-spec.md">REST API</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/07-security.md">Security</a></li>
diff --git a/website/docs/configuration/audit-compliance/index.html b/website/docs/configuration/audit-compliance/index.html
index 00ace7a6..bec6c8a5 100644
--- a/website/docs/configuration/audit-compliance/index.html
+++ b/website/docs/configuration/audit-compliance/index.html
@@ -60,6 +60,8 @@
       "name": "Audit log, compliance reports & data lifecycle \u2014 AccessFlow docs",
       "description": "Read the AccessFlow tamper-evident audit log, generate signed compliance exports, and run data-retention and right-to-erasure policies.",
       "inLanguage": "en",
+      "articleSection": "Configuration",
+      "datePublished": "2026-04-01",
       "dateModified": "2026-08-03",
       "url": "https://accessflow.bablsoft.com/docs/configuration/audit-compliance/",
       "mainEntityOfPage": "https://accessflow.bablsoft.com/docs/configuration/audit-compliance/",
@@ -105,7 +107,13 @@
       "@id": "https://github.com/bablsoft#org",
       "name": "bablsoft",
       "url": "https://github.com/bablsoft",
-      "logo": "https://accessflow.bablsoft.com/favicon.svg"
+      "logo": "https://accessflow.bablsoft.com/favicon.svg",
+      "description": "bablsoft builds AccessFlow, an open-source access proxy that puts AI review, human approval workflows and a tamper-evident audit log in front of databases, cloud data warehouses and outbound APIs.",
+      "foundingDate": "2026-04",
+      "sameAs": [
+        "https://github.com/bablsoft",
+        "https://github.com/bablsoft/accessflow"
+      ]
     }
   ]
 }
@@ -132,8 +140,9 @@
         <a href="/#how">How it works</a>
         <a href="/#use-cases">Use cases</a>
         <a href="/#install">Install</a>
+        <a href="/#questions">Questions</a>
         <a href="/#roadmap">Roadmap</a>
-        <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+        <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
       </nav>
       <details class="nav-mobile">
         <summary aria-label="Open navigation menu">
@@ -147,8 +156,9 @@
           <a href="/#how">How it works</a>
           <a href="/#use-cases">Use cases</a>
           <a href="/#install">Install</a>
+          <a href="/#questions">Questions</a>
           <a href="/#roadmap">Roadmap</a>
-          <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+          <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
           <div class="nav-mobile-divider" aria-hidden="true"></div>
           <button class="theme-toggle nav-mobile-theme" type="button" data-theme-toggle aria-label="Switch to light theme" aria-pressed="false">
             <svg class="theme-toggle-icon theme-toggle-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" width="16" height="16" aria-hidden="true">
@@ -221,6 +231,7 @@
         <header class="docs-hero">
           <span class="eyebrow">Documentation</span>
           <h1>Audit & compliance.</h1>
+          <p class="docs-updated">Last updated <time datetime="2026-08-03">3 August 2026</time></p>
         </header>
 
 <section class="docs-section">
@@ -232,6 +243,10 @@ <h2 id="cfg-audit-log">Audit log</h2>
             append-only and cryptographically chained, so a deleted or altered entry is detectable
             after the fact (query result data is never stored).
           </p>
+          <h3>What makes the AccessFlow audit log tamper-evident?</h3>
+          <p>
+            Every row is append-only and carries an HMAC-SHA256 hash chained to the row before it, so altering or deleting any entry breaks the chain and is detectable. The database role the application uses has no <code>UPDATE</code> or <code>DELETE</code> privilege on the table — a separate writer role only inserts.
+          </p>
           <p>
             <strong>Configure it.</strong> Nothing to switch on — it captures automatically. Review it
             at <code>/admin/audit-log</code>:
@@ -372,13 +387,14 @@ <h3>Product</h3>
             <li><a href="/#how">How it works</a></li>
             <li><a href="/#use-cases">Use cases</a></li>
             <li><a href="/#install">Quick start</a></li>
+            <li><a href="/#questions">Questions</a></li>
             <li><a href="/#roadmap">Roadmap</a></li>
           </ul>
         </div>
         <div class="footer-col">
           <h3>Docs</h3>
           <ul>
-            <li><a href="index.html">User documentation</a></li>
+            <li><a href="/docs/">User documentation</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/02-architecture.md">Architecture</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/04-api-spec.md">REST API</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/07-security.md">Security</a></li>
diff --git a/website/docs/configuration/auth/index.html b/website/docs/configuration/auth/index.html
index 14b66993..b2759704 100644
--- a/website/docs/configuration/auth/index.html
+++ b/website/docs/configuration/auth/index.html
@@ -60,6 +60,8 @@
       "name": "OAuth 2.0 / OIDC & SAML 2.0 SSO \u2014 AccessFlow docs",
       "description": "Connect AccessFlow to your identity provider with OAuth 2.0 / OIDC or SAML 2.0 single sign-on \u2014 Google, GitHub, Microsoft, GitLab, Okta, Keycloak and more.",
       "inLanguage": "en",
+      "articleSection": "Configuration",
+      "datePublished": "2026-04-01",
       "dateModified": "2026-08-03",
       "url": "https://accessflow.bablsoft.com/docs/configuration/auth/",
       "mainEntityOfPage": "https://accessflow.bablsoft.com/docs/configuration/auth/",
@@ -105,7 +107,13 @@
       "@id": "https://github.com/bablsoft#org",
       "name": "bablsoft",
       "url": "https://github.com/bablsoft",
-      "logo": "https://accessflow.bablsoft.com/favicon.svg"
+      "logo": "https://accessflow.bablsoft.com/favicon.svg",
+      "description": "bablsoft builds AccessFlow, an open-source access proxy that puts AI review, human approval workflows and a tamper-evident audit log in front of databases, cloud data warehouses and outbound APIs.",
+      "foundingDate": "2026-04",
+      "sameAs": [
+        "https://github.com/bablsoft",
+        "https://github.com/bablsoft/accessflow"
+      ]
     }
   ]
 }
@@ -132,8 +140,9 @@
         <a href="/#how">How it works</a>
         <a href="/#use-cases">Use cases</a>
         <a href="/#install">Install</a>
+        <a href="/#questions">Questions</a>
         <a href="/#roadmap">Roadmap</a>
-        <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+        <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
       </nav>
       <details class="nav-mobile">
         <summary aria-label="Open navigation menu">
@@ -147,8 +156,9 @@
           <a href="/#how">How it works</a>
           <a href="/#use-cases">Use cases</a>
           <a href="/#install">Install</a>
+          <a href="/#questions">Questions</a>
           <a href="/#roadmap">Roadmap</a>
-          <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+          <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
           <div class="nav-mobile-divider" aria-hidden="true"></div>
           <button class="theme-toggle nav-mobile-theme" type="button" data-theme-toggle aria-label="Switch to light theme" aria-pressed="false">
             <svg class="theme-toggle-icon theme-toggle-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" width="16" height="16" aria-hidden="true">
@@ -219,6 +229,7 @@
         <header class="docs-hero">
           <span class="eyebrow">Documentation</span>
           <h1>Authentication & SSO.</h1>
+          <p class="docs-updated">Last updated <time datetime="2026-08-03">3 August 2026</time></p>
         </header>
 
 <section class="docs-section">
@@ -233,6 +244,10 @@ <h2 id="cfg-oauth">OAuth 2.0 / OIDC</h2>
             Okta, Authentik, Zitadel). It all lives in the database, so adding a provider needs no
             restart.
           </p>
+          <h3>How do users sign in to AccessFlow?</h3>
+          <p>
+            By default, with an email and password issued in AccessFlow, optionally protected by TOTP two-factor. Organizations can instead delegate sign-in to an identity provider over OAuth 2.0 / OIDC or SAML 2.0, in which case users are auto-provisioned on first login and never hold an AccessFlow password.
+          </p>
           <p>
             <strong>Configure it.</strong> Manage providers at <code>/admin/oauth2</code>:
           </p>
@@ -350,13 +365,14 @@ <h3>Product</h3>
             <li><a href="/#how">How it works</a></li>
             <li><a href="/#use-cases">Use cases</a></li>
             <li><a href="/#install">Quick start</a></li>
+            <li><a href="/#questions">Questions</a></li>
             <li><a href="/#roadmap">Roadmap</a></li>
           </ul>
         </div>
         <div class="footer-col">
           <h3>Docs</h3>
           <ul>
-            <li><a href="index.html">User documentation</a></li>
+            <li><a href="/docs/">User documentation</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/02-architecture.md">Architecture</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/04-api-spec.md">REST API</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/07-security.md">Security</a></li>
diff --git a/website/docs/configuration/connectors/index.html b/website/docs/configuration/connectors/index.html
index 691e09d2..52fd8335 100644
--- a/website/docs/configuration/connectors/index.html
+++ b/website/docs/configuration/connectors/index.html
@@ -60,6 +60,8 @@
       "name": "Connectors & API connectors \u2014 AccessFlow docs",
       "description": "Install SQL, NoSQL and data-warehouse engine connectors from the AccessFlow catalog, and register outbound REST, SOAP, GraphQL and gRPC API connectors.",
       "inLanguage": "en",
+      "articleSection": "Configuration",
+      "datePublished": "2026-04-01",
       "dateModified": "2026-08-03",
       "url": "https://accessflow.bablsoft.com/docs/configuration/connectors/",
       "mainEntityOfPage": "https://accessflow.bablsoft.com/docs/configuration/connectors/",
@@ -105,7 +107,13 @@
       "@id": "https://github.com/bablsoft#org",
       "name": "bablsoft",
       "url": "https://github.com/bablsoft",
-      "logo": "https://accessflow.bablsoft.com/favicon.svg"
+      "logo": "https://accessflow.bablsoft.com/favicon.svg",
+      "description": "bablsoft builds AccessFlow, an open-source access proxy that puts AI review, human approval workflows and a tamper-evident audit log in front of databases, cloud data warehouses and outbound APIs.",
+      "foundingDate": "2026-04",
+      "sameAs": [
+        "https://github.com/bablsoft",
+        "https://github.com/bablsoft/accessflow"
+      ]
     }
   ]
 }
@@ -132,8 +140,9 @@
         <a href="/#how">How it works</a>
         <a href="/#use-cases">Use cases</a>
         <a href="/#install">Install</a>
+        <a href="/#questions">Questions</a>
         <a href="/#roadmap">Roadmap</a>
-        <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+        <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
       </nav>
       <details class="nav-mobile">
         <summary aria-label="Open navigation menu">
@@ -147,8 +156,9 @@
           <a href="/#how">How it works</a>
           <a href="/#use-cases">Use cases</a>
           <a href="/#install">Install</a>
+          <a href="/#questions">Questions</a>
           <a href="/#roadmap">Roadmap</a>
-          <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+          <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
           <div class="nav-mobile-divider" aria-hidden="true"></div>
           <button class="theme-toggle nav-mobile-theme" type="button" data-theme-toggle aria-label="Switch to light theme" aria-pressed="false">
             <svg class="theme-toggle-icon theme-toggle-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" width="16" height="16" aria-hidden="true">
@@ -219,6 +229,7 @@
         <header class="docs-hero">
           <span class="eyebrow">Documentation</span>
           <h1>Connectors.</h1>
+          <p class="docs-updated">Last updated <time datetime="2026-08-03">3 August 2026</time></p>
         </header>
 
 <section class="docs-section">
@@ -237,6 +248,53 @@ <h2 id="cfg-connectors">Connectors</h2>
             Elasticsearch, OpenSearch, Amazon DynamoDB, Neo4j, Snowflake, BigQuery, Databricks, and the other SQL drivers — shows an
             <em>Install</em> action.
           </p>
+          <h3 id="cfg-connectors-matrix">Which databases does AccessFlow support?</h3>
+          <p>
+            AccessFlow ships connectors for 18 engines across three families. Relational engines run
+            over pooled JDBC; data-warehouse and NoSQL engines run through native plugins that are
+            downloaded on demand, SHA-256-verified, and cached. Every engine gets the same review
+            pipeline, masking, and audit log — only the query language and the row-security
+            mechanics differ.
+          </p>
+          <div class="docs-table-wrap">
+            <table class="docs-table" aria-label="Supported database engines by family, query language, row-level security mechanism, and install method">
+              <thead>
+                <tr>
+                  <th>Engine</th>
+                  <th>Family</th>
+                  <th>Query language</th>
+                  <th>Row-level security</th>
+                  <th>Install</th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr><td>PostgreSQL</td><td>Relational</td><td>SQL</td><td>WHERE-clause splice</td><td>Bundled</td></tr>
+                <tr><td>MySQL</td><td>Relational</td><td>SQL</td><td>WHERE-clause splice</td><td>1-click</td></tr>
+                <tr><td>MariaDB</td><td>Relational</td><td>SQL</td><td>WHERE-clause splice</td><td>1-click</td></tr>
+                <tr><td>Oracle Database</td><td>Relational</td><td>SQL</td><td>WHERE-clause splice</td><td>1-click</td></tr>
+                <tr><td>Microsoft SQL Server</td><td>Relational</td><td>SQL</td><td>WHERE-clause splice</td><td>1-click</td></tr>
+                <tr><td>ClickHouse</td><td>Relational (<code>CUSTOM</code>)</td><td>SQL</td><td>WHERE-clause splice</td><td>1-click</td></tr>
+                <tr><td>Snowflake</td><td>Data warehouse</td><td>Snowflake SQL</td><td>WHERE splice, fail-closed</td><td>1-click</td></tr>
+                <tr><td>Google BigQuery</td><td>Data warehouse</td><td>GoogleSQL</td><td>WHERE splice, fail-closed</td><td>1-click</td></tr>
+                <tr><td>Databricks SQL</td><td>Data warehouse</td><td>Databricks SQL</td><td>WHERE splice, fail-closed</td><td>1-click</td></tr>
+                <tr><td>MongoDB</td><td>Document</td><td>Mongo shell / JSON command</td><td><code>$match</code> injection</td><td>1-click</td></tr>
+                <tr><td>Couchbase</td><td>Document</td><td>SQL++ (N1QL)</td><td>WHERE splice, fail-closed</td><td>1-click</td></tr>
+                <tr><td>Redis</td><td>Key-value</td><td>redis-cli commands</td><td>Fails closed — no row concept</td><td>1-click</td></tr>
+                <tr><td>Amazon DynamoDB</td><td>Key-value</td><td>PartiQL</td><td>WHERE splice, any attribute</td><td>1-click</td></tr>
+                <tr><td>Apache Cassandra</td><td>Wide-column</td><td>CQL</td><td>Key-aware splice, fail-closed</td><td>1-click</td></tr>
+                <tr><td>ScyllaDB</td><td>Wide-column</td><td>CQL</td><td>Key-aware splice, fail-closed</td><td>1-click</td></tr>
+                <tr><td>Elasticsearch</td><td>Search</td><td>JSON Query DSL</td><td><code>bool.filter</code> on keyword fields</td><td>1-click</td></tr>
+                <tr><td>OpenSearch</td><td>Search</td><td>JSON Query DSL</td><td><code>bool.filter</code> on keyword fields</td><td>1-click</td></tr>
+                <tr><td>Neo4j</td><td>Graph</td><td>Cypher</td><td><code>MATCH</code> WHERE splice, fail-closed</td><td>1-click</td></tr>
+              </tbody>
+            </table>
+          </div>
+          <p>
+            Any other JDBC-compatible engine can be added by uploading its driver JAR and creating a
+            <em>Custom</em> datasource. The per-engine detail — ports, credential shapes, and what
+            each engine rejects up front — follows below.
+          </p>
+
           <p><strong>Built-in connectors — SQL:</strong></p>
           <ul>
             <li><strong>PostgreSQL</strong> — bundled (ships in the image, no download).</li>
@@ -415,13 +473,14 @@ <h3>Product</h3>
             <li><a href="/#how">How it works</a></li>
             <li><a href="/#use-cases">Use cases</a></li>
             <li><a href="/#install">Quick start</a></li>
+            <li><a href="/#questions">Questions</a></li>
             <li><a href="/#roadmap">Roadmap</a></li>
           </ul>
         </div>
         <div class="footer-col">
           <h3>Docs</h3>
           <ul>
-            <li><a href="index.html">User documentation</a></li>
+            <li><a href="/docs/">User documentation</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/02-architecture.md">Architecture</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/04-api-spec.md">REST API</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/07-security.md">Security</a></li>
diff --git a/website/docs/configuration/datasources/index.html b/website/docs/configuration/datasources/index.html
index 516115ea..6d4b0fdb 100644
--- a/website/docs/configuration/datasources/index.html
+++ b/website/docs/configuration/datasources/index.html
@@ -60,6 +60,8 @@
       "name": "Datasources, masking & row security \u2014 AccessFlow docs",
       "description": "Add governed datasources to AccessFlow, tag sensitive columns, apply masking and row-level security policies, upload JDBC drivers, and watch pool health.",
       "inLanguage": "en",
+      "articleSection": "Configuration",
+      "datePublished": "2026-04-01",
       "dateModified": "2026-08-03",
       "url": "https://accessflow.bablsoft.com/docs/configuration/datasources/",
       "mainEntityOfPage": "https://accessflow.bablsoft.com/docs/configuration/datasources/",
@@ -105,7 +107,13 @@
       "@id": "https://github.com/bablsoft#org",
       "name": "bablsoft",
       "url": "https://github.com/bablsoft",
-      "logo": "https://accessflow.bablsoft.com/favicon.svg"
+      "logo": "https://accessflow.bablsoft.com/favicon.svg",
+      "description": "bablsoft builds AccessFlow, an open-source access proxy that puts AI review, human approval workflows and a tamper-evident audit log in front of databases, cloud data warehouses and outbound APIs.",
+      "foundingDate": "2026-04",
+      "sameAs": [
+        "https://github.com/bablsoft",
+        "https://github.com/bablsoft/accessflow"
+      ]
     }
   ]
 }
@@ -132,8 +140,9 @@
         <a href="/#how">How it works</a>
         <a href="/#use-cases">Use cases</a>
         <a href="/#install">Install</a>
+        <a href="/#questions">Questions</a>
         <a href="/#roadmap">Roadmap</a>
-        <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+        <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
       </nav>
       <details class="nav-mobile">
         <summary aria-label="Open navigation menu">
@@ -147,8 +156,9 @@
           <a href="/#how">How it works</a>
           <a href="/#use-cases">Use cases</a>
           <a href="/#install">Install</a>
+          <a href="/#questions">Questions</a>
           <a href="/#roadmap">Roadmap</a>
-          <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+          <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
           <div class="nav-mobile-divider" aria-hidden="true"></div>
           <button class="theme-toggle nav-mobile-theme" type="button" data-theme-toggle aria-label="Switch to light theme" aria-pressed="false">
             <svg class="theme-toggle-icon theme-toggle-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" width="16" height="16" aria-hidden="true">
@@ -220,6 +230,7 @@
         <header class="docs-hero">
           <span class="eyebrow">Documentation</span>
           <h1>Datasources.</h1>
+          <p class="docs-updated">Last updated <time datetime="2026-08-03">3 August 2026</time></p>
         </header>
 
 <section class="docs-section">
@@ -234,6 +245,10 @@ <h2 id="cfg-datasources">Datasources</h2>
             from the <a href="/docs/configuration/connectors/#cfg-connectors">connector catalog</a>; any other JDBC engine works by uploading
             its <a href="#cfg-drivers">driver</a> and choosing <em>Custom</em>.
           </p>
+          <h3>What is a datasource in AccessFlow?</h3>
+          <p>
+            A datasource is a governed connection to one of your databases. Users never receive its credentials — they submit queries to AccessFlow, which reviews them and then executes them over the pooled connection on their behalf. Masking, row-level security, schema allow-lists, and row caps are all configured per datasource.
+          </p>
           <p>
             <strong>Configure it.</strong> Create one with the four-step wizard at
             <code>/datasources/new</code>:
@@ -549,13 +564,14 @@ <h3>Product</h3>
             <li><a href="/#how">How it works</a></li>
             <li><a href="/#use-cases">Use cases</a></li>
             <li><a href="/#install">Quick start</a></li>
+            <li><a href="/#questions">Questions</a></li>
             <li><a href="/#roadmap">Roadmap</a></li>
           </ul>
         </div>
         <div class="footer-col">
           <h3>Docs</h3>
           <ul>
-            <li><a href="index.html">User documentation</a></li>
+            <li><a href="/docs/">User documentation</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/02-architecture.md">Architecture</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/04-api-spec.md">REST API</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/07-security.md">Security</a></li>
diff --git a/website/docs/configuration/notifications/index.html b/website/docs/configuration/notifications/index.html
index 8d27de79..989433be 100644
--- a/website/docs/configuration/notifications/index.html
+++ b/website/docs/configuration/notifications/index.html
@@ -60,6 +60,8 @@
       "name": "Notification channels & SMTP \u2014 AccessFlow docs",
       "description": "Route AccessFlow review and audit events to email, Slack, Discord, Telegram, Teams, PagerDuty, ServiceNow, Jira and signed webhooks, and configure system SMTP.",
       "inLanguage": "en",
+      "articleSection": "Configuration",
+      "datePublished": "2026-04-01",
       "dateModified": "2026-08-03",
       "url": "https://accessflow.bablsoft.com/docs/configuration/notifications/",
       "mainEntityOfPage": "https://accessflow.bablsoft.com/docs/configuration/notifications/",
@@ -105,7 +107,13 @@
       "@id": "https://github.com/bablsoft#org",
       "name": "bablsoft",
       "url": "https://github.com/bablsoft",
-      "logo": "https://accessflow.bablsoft.com/favicon.svg"
+      "logo": "https://accessflow.bablsoft.com/favicon.svg",
+      "description": "bablsoft builds AccessFlow, an open-source access proxy that puts AI review, human approval workflows and a tamper-evident audit log in front of databases, cloud data warehouses and outbound APIs.",
+      "foundingDate": "2026-04",
+      "sameAs": [
+        "https://github.com/bablsoft",
+        "https://github.com/bablsoft/accessflow"
+      ]
     }
   ]
 }
@@ -132,8 +140,9 @@
         <a href="/#how">How it works</a>
         <a href="/#use-cases">Use cases</a>
         <a href="/#install">Install</a>
+        <a href="/#questions">Questions</a>
         <a href="/#roadmap">Roadmap</a>
-        <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+        <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
       </nav>
       <details class="nav-mobile">
         <summary aria-label="Open navigation menu">
@@ -147,8 +156,9 @@
           <a href="/#how">How it works</a>
           <a href="/#use-cases">Use cases</a>
           <a href="/#install">Install</a>
+          <a href="/#questions">Questions</a>
           <a href="/#roadmap">Roadmap</a>
-          <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+          <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
           <div class="nav-mobile-divider" aria-hidden="true"></div>
           <button class="theme-toggle nav-mobile-theme" type="button" data-theme-toggle aria-label="Switch to light theme" aria-pressed="false">
             <svg class="theme-toggle-icon theme-toggle-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" width="16" height="16" aria-hidden="true">
@@ -219,6 +229,7 @@
         <header class="docs-hero">
           <span class="eyebrow">Documentation</span>
           <h1>Notifications.</h1>
+          <p class="docs-updated">Last updated <time datetime="2026-08-03">3 August 2026</time></p>
         </header>
 
 <section class="docs-section">
@@ -229,6 +240,10 @@ <h2 id="cfg-notification-channels">Notification channels</h2>
             up the channels your team already lives in so reviewers act fast. Configure as many as you
             like per organization (e.g. one Slack channel per team).
           </p>
+          <h3>Where can AccessFlow send review notifications?</h3>
+          <p>
+            Email, Slack, Discord, Telegram, Microsoft Teams, PagerDuty, ServiceNow, Jira, and signed HTTP webhooks. Configure as many channels as you need per organization and pick which events each one receives — query submitted, approved, rejected, timed out, or scored CRITICAL by AI risk analysis.
+          </p>
           <p>
             <strong>Configure it.</strong> Manage channels at <code>/admin/notifications</code>:
           </p>
@@ -387,13 +402,14 @@ <h3>Product</h3>
             <li><a href="/#how">How it works</a></li>
             <li><a href="/#use-cases">Use cases</a></li>
             <li><a href="/#install">Quick start</a></li>
+            <li><a href="/#questions">Questions</a></li>
             <li><a href="/#roadmap">Roadmap</a></li>
           </ul>
         </div>
         <div class="footer-col">
           <h3>Docs</h3>
           <ul>
-            <li><a href="index.html">User documentation</a></li>
+            <li><a href="/docs/">User documentation</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/02-architecture.md">Architecture</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/04-api-spec.md">REST API</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/07-security.md">Security</a></li>
diff --git a/website/docs/configuration/review-workflows/index.html b/website/docs/configuration/review-workflows/index.html
index 94d8dc51..9a451e0e 100644
--- a/website/docs/configuration/review-workflows/index.html
+++ b/website/docs/configuration/review-workflows/index.html
@@ -60,6 +60,8 @@
       "name": "Review plans, routing policies & recertification \u2014 AccessFlow docs",
       "description": "Build multi-stage approval chains with AccessFlow review plans, automate decisions with policy-as-code routing, and run access recertification campaigns.",
       "inLanguage": "en",
+      "articleSection": "Configuration",
+      "datePublished": "2026-04-01",
       "dateModified": "2026-08-03",
       "url": "https://accessflow.bablsoft.com/docs/configuration/review-workflows/",
       "mainEntityOfPage": "https://accessflow.bablsoft.com/docs/configuration/review-workflows/",
@@ -105,7 +107,13 @@
       "@id": "https://github.com/bablsoft#org",
       "name": "bablsoft",
       "url": "https://github.com/bablsoft",
-      "logo": "https://accessflow.bablsoft.com/favicon.svg"
+      "logo": "https://accessflow.bablsoft.com/favicon.svg",
+      "description": "bablsoft builds AccessFlow, an open-source access proxy that puts AI review, human approval workflows and a tamper-evident audit log in front of databases, cloud data warehouses and outbound APIs.",
+      "foundingDate": "2026-04",
+      "sameAs": [
+        "https://github.com/bablsoft",
+        "https://github.com/bablsoft/accessflow"
+      ]
     }
   ]
 }
@@ -132,8 +140,9 @@
         <a href="/#how">How it works</a>
         <a href="/#use-cases">Use cases</a>
         <a href="/#install">Install</a>
+        <a href="/#questions">Questions</a>
         <a href="/#roadmap">Roadmap</a>
-        <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+        <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
       </nav>
       <details class="nav-mobile">
         <summary aria-label="Open navigation menu">
@@ -147,8 +156,9 @@
           <a href="/#how">How it works</a>
           <a href="/#use-cases">Use cases</a>
           <a href="/#install">Install</a>
+          <a href="/#questions">Questions</a>
           <a href="/#roadmap">Roadmap</a>
-          <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+          <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
           <div class="nav-mobile-divider" aria-hidden="true"></div>
           <button class="theme-toggle nav-mobile-theme" type="button" data-theme-toggle aria-label="Switch to light theme" aria-pressed="false">
             <svg class="theme-toggle-icon theme-toggle-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" width="16" height="16" aria-hidden="true">
@@ -220,6 +230,7 @@
         <header class="docs-hero">
           <span class="eyebrow">Documentation</span>
           <h1>Review workflows.</h1>
+          <p class="docs-updated">Last updated <time datetime="2026-08-03">3 August 2026</time></p>
         </header>
 
 <section class="docs-section">
@@ -260,6 +271,60 @@ <h2 id="cfg-review-plans">Review plans</h2>
             <li><strong>Set thresholds.</strong> <em>Minimum approvals</em> is the number of distinct reviewers needed before the query advances; <em>Approval timeout (hours)</em> is when AccessFlow auto-rejects an idle <code>PENDING_REVIEW</code> query (it scans on a cadence set by <code>ACCESSFLOW_WORKFLOW_TIMEOUT_POLL_INTERVAL</code>, default <code>PT5M</code>).</li>
             <li><strong>Build the approver chain.</strong> Click <em>Add approver</em> for each stage; each row names a role (or a specific user) and a stage number. Stages advance sequentially, and a single <em>REJECTED</em> decision at any stage terminates the query.</li>
           </ol>
+          <h3 id="cfg-review-plan-settings">What can a review plan control?</h3>
+          <p>
+            A review plan is six settings plus an approver chain. Together they decide whether a
+            query needs AI scoring, how many humans must sign off, which of them, and what happens
+            if nobody does. Every setting below is per-plan, and a plan attaches to a datasource.
+          </p>
+          <div class="docs-table-wrap">
+            <table class="docs-table" aria-label="Review plan settings, what each one does, and the effect when it is disabled">
+              <thead>
+                <tr>
+                  <th>Setting</th>
+                  <th>What it does</th>
+                  <th>When disabled / unset</th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr>
+                  <td>Require AI review</td>
+                  <td>Every query is scored for risk before it queues for humans.</td>
+                  <td>The query skips <code>PENDING_AI</code> and goes straight to review.</td>
+                </tr>
+                <tr>
+                  <td>Require human approval</td>
+                  <td>At least one reviewer must sign off before execution.</td>
+                  <td>The query is approved without a human — AI-only gating.</td>
+                </tr>
+                <tr>
+                  <td>Auto-approve LOW-risk reads</td>
+                  <td><code>SELECT</code>s below the AI risk threshold skip human approval.</td>
+                  <td>Reads queue for review like any other statement.</td>
+                </tr>
+                <tr>
+                  <td>Minimum approvals</td>
+                  <td>How many distinct reviewers must approve before the query advances.</td>
+                  <td>Defaults to one approval per stage.</td>
+                </tr>
+                <tr>
+                  <td>Approval timeout (hours)</td>
+                  <td>How long an idle <code>PENDING_REVIEW</code> query waits before auto-rejection.</td>
+                  <td>The query waits indefinitely for a decision.</td>
+                </tr>
+                <tr>
+                  <td>Approver chain</td>
+                  <td>Ordered stages, each naming a role or a specific user as approver.</td>
+                  <td>No chain means no staged escalation — one flat approval step.</td>
+                </tr>
+              </tbody>
+            </table>
+          </div>
+          <p>
+            Stages advance sequentially and a single <em>Reject</em> at any stage terminates the
+            query. A user can never approve their own query, whatever their role.
+          </p>
+
           <p>
             <strong>Reviewer decisions.</strong> Reviewers can <em>Approve</em>, <em>Reject</em>, or
             <em>Request changes</em>. <em>Reject</em> and <em>Request changes</em> both require a
@@ -407,13 +472,14 @@ <h3>Product</h3>
             <li><a href="/#how">How it works</a></li>
             <li><a href="/#use-cases">Use cases</a></li>
             <li><a href="/#install">Quick start</a></li>
+            <li><a href="/#questions">Questions</a></li>
             <li><a href="/#roadmap">Roadmap</a></li>
           </ul>
         </div>
         <div class="footer-col">
           <h3>Docs</h3>
           <ul>
-            <li><a href="index.html">User documentation</a></li>
+            <li><a href="/docs/">User documentation</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/02-architecture.md">Architecture</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/04-api-spec.md">REST API</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/07-security.md">Security</a></li>
diff --git a/website/docs/configuration/users-roles/index.html b/website/docs/configuration/users-roles/index.html
index d3874f5a..f381bf69 100644
--- a/website/docs/configuration/users-roles/index.html
+++ b/website/docs/configuration/users-roles/index.html
@@ -60,6 +60,8 @@
       "name": "Users, roles & organizations \u2014 AccessFlow docs",
       "description": "Configure AccessFlow organizations and quotas, invite users, assign RBAC roles, group them, and grant just-in-time or break-glass access.",
       "inLanguage": "en",
+      "articleSection": "Configuration",
+      "datePublished": "2026-04-01",
       "dateModified": "2026-08-03",
       "url": "https://accessflow.bablsoft.com/docs/configuration/users-roles/",
       "mainEntityOfPage": "https://accessflow.bablsoft.com/docs/configuration/users-roles/",
@@ -105,7 +107,13 @@
       "@id": "https://github.com/bablsoft#org",
       "name": "bablsoft",
       "url": "https://github.com/bablsoft",
-      "logo": "https://accessflow.bablsoft.com/favicon.svg"
+      "logo": "https://accessflow.bablsoft.com/favicon.svg",
+      "description": "bablsoft builds AccessFlow, an open-source access proxy that puts AI review, human approval workflows and a tamper-evident audit log in front of databases, cloud data warehouses and outbound APIs.",
+      "foundingDate": "2026-04",
+      "sameAs": [
+        "https://github.com/bablsoft",
+        "https://github.com/bablsoft/accessflow"
+      ]
     }
   ]
 }
@@ -132,8 +140,9 @@
         <a href="/#how">How it works</a>
         <a href="/#use-cases">Use cases</a>
         <a href="/#install">Install</a>
+        <a href="/#questions">Questions</a>
         <a href="/#roadmap">Roadmap</a>
-        <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+        <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
       </nav>
       <details class="nav-mobile">
         <summary aria-label="Open navigation menu">
@@ -147,8 +156,9 @@
           <a href="/#how">How it works</a>
           <a href="/#use-cases">Use cases</a>
           <a href="/#install">Install</a>
+          <a href="/#questions">Questions</a>
           <a href="/#roadmap">Roadmap</a>
-          <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+          <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
           <div class="nav-mobile-divider" aria-hidden="true"></div>
           <button class="theme-toggle nav-mobile-theme" type="button" data-theme-toggle aria-label="Switch to light theme" aria-pressed="false">
             <svg class="theme-toggle-icon theme-toggle-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" width="16" height="16" aria-hidden="true">
@@ -222,6 +232,7 @@
         <header class="docs-hero">
           <span class="eyebrow">Documentation</span>
           <h1>Users, roles & organizations.</h1>
+          <p class="docs-updated">Last updated <time datetime="2026-08-03">3 August 2026</time></p>
         </header>
 
 <section class="docs-section">
@@ -352,6 +363,10 @@ <h2 id="cfg-roles">User roles &amp; RBAC</h2>
             databases they may touch. Pick the lowest-privilege role that still lets someone do their
             job — and a user can never approve their own query, whatever their role.
           </p>
+          <h3>What are the user roles in AccessFlow?</h3>
+          <p>
+            AccessFlow has five org-wide roles. <code>READONLY</code> submits <code>SELECT</code> queries only. <code>ANALYST</code> adds DML. <code>REVIEWER</code> adds approving other people’s queries. <code>ADMIN</code> adds DDL and every configuration screen. <code>AUDITOR</code> is read-only across the audit log and compliance reports, and cannot submit queries at all.
+          </p>
           <p>
             <strong>Custom roles.</strong> Beyond the five built-in system roles, an admin can compose
             <em>custom roles</em> on <code>/admin/roles</code> from a fixed catalog of functional
@@ -593,13 +608,14 @@ <h3>Product</h3>
             <li><a href="/#how">How it works</a></li>
             <li><a href="/#use-cases">Use cases</a></li>
             <li><a href="/#install">Quick start</a></li>
+            <li><a href="/#questions">Questions</a></li>
             <li><a href="/#roadmap">Roadmap</a></li>
           </ul>
         </div>
         <div class="footer-col">
           <h3>Docs</h3>
           <ul>
-            <li><a href="index.html">User documentation</a></li>
+            <li><a href="/docs/">User documentation</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/02-architecture.md">Architecture</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/04-api-spec.md">REST API</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/07-security.md">Security</a></li>
diff --git a/website/docs/iac/index.html b/website/docs/iac/index.html
index a57f2ddd..d40d93d7 100644
--- a/website/docs/iac/index.html
+++ b/website/docs/iac/index.html
@@ -60,6 +60,8 @@
       "name": "Terraform / OpenTofu provider & CI Actions \u2014 AccessFlow docs",
       "description": "Manage AccessFlow declaratively with the Terraform / OpenTofu provider, service-account API keys, and the reusable GitHub Actions and GitLab CI templates.",
       "inLanguage": "en",
+      "articleSection": "Infrastructure as Code",
+      "datePublished": "2026-04-01",
       "dateModified": "2026-08-03",
       "url": "https://accessflow.bablsoft.com/docs/iac/",
       "mainEntityOfPage": "https://accessflow.bablsoft.com/docs/iac/",
@@ -105,7 +107,13 @@
       "@id": "https://github.com/bablsoft#org",
       "name": "bablsoft",
       "url": "https://github.com/bablsoft",
-      "logo": "https://accessflow.bablsoft.com/favicon.svg"
+      "logo": "https://accessflow.bablsoft.com/favicon.svg",
+      "description": "bablsoft builds AccessFlow, an open-source access proxy that puts AI review, human approval workflows and a tamper-evident audit log in front of databases, cloud data warehouses and outbound APIs.",
+      "foundingDate": "2026-04",
+      "sameAs": [
+        "https://github.com/bablsoft",
+        "https://github.com/bablsoft/accessflow"
+      ]
     }
   ]
 }
@@ -132,8 +140,9 @@
         <a href="/#how">How it works</a>
         <a href="/#use-cases">Use cases</a>
         <a href="/#install">Install</a>
+        <a href="/#questions">Questions</a>
         <a href="/#roadmap">Roadmap</a>
-        <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+        <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
       </nav>
       <details class="nav-mobile">
         <summary aria-label="Open navigation menu">
@@ -147,8 +156,9 @@
           <a href="/#how">How it works</a>
           <a href="/#use-cases">Use cases</a>
           <a href="/#install">Install</a>
+          <a href="/#questions">Questions</a>
           <a href="/#roadmap">Roadmap</a>
-          <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+          <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
           <div class="nav-mobile-divider" aria-hidden="true"></div>
           <button class="theme-toggle nav-mobile-theme" type="button" data-theme-toggle aria-label="Switch to light theme" aria-pressed="false">
             <svg class="theme-toggle-icon theme-toggle-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" width="16" height="16" aria-hidden="true">
@@ -218,6 +228,7 @@
         <header class="docs-hero">
           <span class="eyebrow">Documentation</span>
           <h1>Infrastructure as Code.</h1>
+          <p class="docs-updated">Last updated <time datetime="2026-08-03">3 August 2026</time></p>
         </header>
 
 <section id="iac" class="docs-section">
@@ -230,6 +241,11 @@ <h2>Infrastructure as Code (Terraform / OpenTofu &amp; CI Actions)</h2>
             API key — the provider manages datasources, review plans, routing / row-security /
             masking policies, AI configs, and notification channels with the same authoritative-upsert
             semantics as the bootstrap reconciler.
+
+          <h3>Can AccessFlow be managed with Terraform?</h3>
+          <p>
+            Yes. The official <code>bablsoft/accessflow</code> provider works with both Terraform and OpenTofu, and manages datasources, review plans, routing, row-security and masking policies, AI configs, and notification channels. It authenticates with a service-account API key and upserts declaratively, the same way the GitOps bootstrap reconciler does.
+          </p>
           </p>
 
           <h3 id="iac-service-account">Service-account API keys</h3>
@@ -417,13 +433,14 @@ <h3>Product</h3>
             <li><a href="/#how">How it works</a></li>
             <li><a href="/#use-cases">Use cases</a></li>
             <li><a href="/#install">Quick start</a></li>
+            <li><a href="/#questions">Questions</a></li>
             <li><a href="/#roadmap">Roadmap</a></li>
           </ul>
         </div>
         <div class="footer-col">
           <h3>Docs</h3>
           <ul>
-            <li><a href="index.html">User documentation</a></li>
+            <li><a href="/docs/">User documentation</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/02-architecture.md">Architecture</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/04-api-spec.md">REST API</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/07-security.md">Security</a></li>
diff --git a/website/docs/index.html b/website/docs/index.html
index cb514556..385392ce 100644
--- a/website/docs/index.html
+++ b/website/docs/index.html
@@ -60,6 +60,8 @@
       "name": "AccessFlow Documentation",
       "description": "Operator and admin documentation for AccessFlow \u2014 install it, complete first-run setup, and configure every entity in the review pipeline.",
       "inLanguage": "en",
+      "articleSection": "Documentation",
+      "datePublished": "2026-04-01",
       "dateModified": "2026-08-03",
       "url": "https://accessflow.bablsoft.com/docs/",
       "mainEntityOfPage": "https://accessflow.bablsoft.com/docs/",
@@ -99,7 +101,13 @@
       "@id": "https://github.com/bablsoft#org",
       "name": "bablsoft",
       "url": "https://github.com/bablsoft",
-      "logo": "https://accessflow.bablsoft.com/favicon.svg"
+      "logo": "https://accessflow.bablsoft.com/favicon.svg",
+      "description": "bablsoft builds AccessFlow, an open-source access proxy that puts AI review, human approval workflows and a tamper-evident audit log in front of databases, cloud data warehouses and outbound APIs.",
+      "foundingDate": "2026-04",
+      "sameAs": [
+        "https://github.com/bablsoft",
+        "https://github.com/bablsoft/accessflow"
+      ]
     }
   ]
 }
@@ -126,8 +134,9 @@
         <a href="/#how">How it works</a>
         <a href="/#use-cases">Use cases</a>
         <a href="/#install">Install</a>
+        <a href="/#questions">Questions</a>
         <a href="/#roadmap">Roadmap</a>
-        <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+        <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
       </nav>
       <details class="nav-mobile">
         <summary aria-label="Open navigation menu">
@@ -141,8 +150,9 @@
           <a href="/#how">How it works</a>
           <a href="/#use-cases">Use cases</a>
           <a href="/#install">Install</a>
+          <a href="/#questions">Questions</a>
           <a href="/#roadmap">Roadmap</a>
-          <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+          <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
           <div class="nav-mobile-divider" aria-hidden="true"></div>
           <button class="theme-toggle nav-mobile-theme" type="button" data-theme-toggle aria-label="Switch to light theme" aria-pressed="false">
             <svg class="theme-toggle-icon theme-toggle-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" width="16" height="16" aria-hidden="true">
@@ -214,21 +224,26 @@
         <header class="docs-hero">
           <span class="eyebrow">Documentation</span>
           <h1>Run and configure AccessFlow.</h1>
+          <p class="docs-updated">Last updated <time datetime="2026-08-03">3 August 2026</time></p>
         </header>
 
 <section id="getting-started" class="docs-section">
           <h2>Read this first</h2>
+
+          <h3 id="what-is-accessflow">What is AccessFlow?</h3>
           <p>
             AccessFlow is a self-hosted query proxy. Your team connects to AccessFlow instead of
-            directly to PostgreSQL, MySQL, MariaDB, Oracle, Microsoft SQL Server (or any other
-            JDBC-compatible engine, via an admin-uploaded driver), the NoSQL document engines
-            MongoDB and Couchbase, the NoSQL key-value engines Redis and Amazon DynamoDB, the NoSQL
-            wide-column engines Apache Cassandra and ScyllaDB, the NoSQL search engines
-            Elasticsearch and OpenSearch, the NoSQL graph engine Neo4j, or the cloud data warehouses
-            Snowflake, Google BigQuery, and Databricks SQL. Every statement is parsed,
-            classified, optionally AI-reviewed, and routed through a configurable human-approval
-            workflow before it touches the database. Customer-database credentials never leave the
-            proxy.
+            connecting to the database directly. Every statement is parsed, classified, optionally
+            AI-reviewed, and routed through a configurable human-approval workflow before it touches
+            the database — and customer-database credentials never leave the proxy.
+          </p>
+          <p>
+            The engines it proxies are PostgreSQL, MySQL, MariaDB, Oracle, and Microsoft SQL Server
+            (or any other JDBC-compatible engine, via an admin-uploaded driver); the NoSQL document
+            engines MongoDB and Couchbase; the NoSQL key-value engines Redis and Amazon DynamoDB;
+            the NoSQL wide-column engines Apache Cassandra and ScyllaDB; the NoSQL search engines
+            Elasticsearch and OpenSearch; the NoSQL graph engine Neo4j; and the cloud data
+            warehouses Snowflake, Google BigQuery, and Databricks SQL.
           </p>
           <p>
             This guide is split into three parts: <a href="/docs/install/#running">running</a> AccessFlow (pick
@@ -365,13 +380,14 @@ <h3>Product</h3>
             <li><a href="/#how">How it works</a></li>
             <li><a href="/#use-cases">Use cases</a></li>
             <li><a href="/#install">Quick start</a></li>
+            <li><a href="/#questions">Questions</a></li>
             <li><a href="/#roadmap">Roadmap</a></li>
           </ul>
         </div>
         <div class="footer-col">
           <h3>Docs</h3>
           <ul>
-            <li><a href="index.html">User documentation</a></li>
+            <li><a href="/docs/">User documentation</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/02-architecture.md">Architecture</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/04-api-spec.md">REST API</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/07-security.md">Security</a></li>
diff --git a/website/docs/install/index.html b/website/docs/install/index.html
index 62ab28c0..96bf0f9e 100644
--- a/website/docs/install/index.html
+++ b/website/docs/install/index.html
@@ -60,6 +60,8 @@
       "name": "Installing AccessFlow \u2014 Docker Compose, Helm, from source",
       "description": "Run AccessFlow with Docker Compose, Kubernetes and Helm, or from source, then complete first-time setup with the browser wizard or GitOps bootstrap.",
       "inLanguage": "en",
+      "articleSection": "Installation",
+      "datePublished": "2026-04-01",
       "dateModified": "2026-08-03",
       "url": "https://accessflow.bablsoft.com/docs/install/",
       "mainEntityOfPage": "https://accessflow.bablsoft.com/docs/install/",
@@ -105,7 +107,13 @@
       "@id": "https://github.com/bablsoft#org",
       "name": "bablsoft",
       "url": "https://github.com/bablsoft",
-      "logo": "https://accessflow.bablsoft.com/favicon.svg"
+      "logo": "https://accessflow.bablsoft.com/favicon.svg",
+      "description": "bablsoft builds AccessFlow, an open-source access proxy that puts AI review, human approval workflows and a tamper-evident audit log in front of databases, cloud data warehouses and outbound APIs.",
+      "foundingDate": "2026-04",
+      "sameAs": [
+        "https://github.com/bablsoft",
+        "https://github.com/bablsoft/accessflow"
+      ]
     }
   ]
 }
@@ -132,8 +140,9 @@
         <a href="/#how">How it works</a>
         <a href="/#use-cases">Use cases</a>
         <a href="/#install">Install</a>
+        <a href="/#questions">Questions</a>
         <a href="/#roadmap">Roadmap</a>
-        <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+        <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
       </nav>
       <details class="nav-mobile">
         <summary aria-label="Open navigation menu">
@@ -147,8 +156,9 @@
           <a href="/#how">How it works</a>
           <a href="/#use-cases">Use cases</a>
           <a href="/#install">Install</a>
+          <a href="/#questions">Questions</a>
           <a href="/#roadmap">Roadmap</a>
-          <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+          <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
           <div class="nav-mobile-divider" aria-hidden="true"></div>
           <button class="theme-toggle nav-mobile-theme" type="button" data-theme-toggle aria-label="Switch to light theme" aria-pressed="false">
             <svg class="theme-toggle-icon theme-toggle-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" width="16" height="16" aria-hidden="true">
@@ -219,6 +229,7 @@
         <header class="docs-hero">
           <span class="eyebrow">Documentation</span>
           <h1>Install AccessFlow.</h1>
+          <p class="docs-updated">Last updated <time datetime="2026-08-03">3 August 2026</time></p>
         </header>
 
 <section id="running" class="docs-section">
@@ -229,6 +240,11 @@ <h2>Running AccessFlow</h2>
             is for contributors and for environments where containers aren't available.
           </p>
 
+          <h3>How do I install AccessFlow?</h3>
+          <p>
+            Three ways. <code>docker compose up</code> against the repo root gives you a running demo stack in under a minute. <code>helm install</code> from the published chart is the production path on Kubernetes, generating its own secrets on first install. Building from source needs JDK 25 and Node.js 24, and is aimed at contributors.
+          </p>
+
           <h3 id="run-docker-compose">Docker Compose</h3>
           <p>
             The repo root ships a <strong>zero-config demo stack</strong> — it pulls the published
@@ -662,13 +678,14 @@ <h3>Product</h3>
             <li><a href="/#how">How it works</a></li>
             <li><a href="/#use-cases">Use cases</a></li>
             <li><a href="/#install">Quick start</a></li>
+            <li><a href="/#questions">Questions</a></li>
             <li><a href="/#roadmap">Roadmap</a></li>
           </ul>
         </div>
         <div class="footer-col">
           <h3>Docs</h3>
           <ul>
-            <li><a href="index.html">User documentation</a></li>
+            <li><a href="/docs/">User documentation</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/02-architecture.md">Architecture</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/04-api-spec.md">REST API</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/07-security.md">Security</a></li>
diff --git a/website/docs/workflows/index.html b/website/docs/workflows/index.html
index 27883405..721d1cdd 100644
--- a/website/docs/workflows/index.html
+++ b/website/docs/workflows/index.html
@@ -60,6 +60,8 @@
       "name": "End-user workflows \u2014 submit, review & approve queries",
       "description": "How analysts submit queries and API calls in AccessFlow, draft SQL from natural language, schedule runs, and how reviewers approve or reject them.",
       "inLanguage": "en",
+      "articleSection": "Workflows",
+      "datePublished": "2026-04-01",
       "dateModified": "2026-08-03",
       "url": "https://accessflow.bablsoft.com/docs/workflows/",
       "mainEntityOfPage": "https://accessflow.bablsoft.com/docs/workflows/",
@@ -105,7 +107,13 @@
       "@id": "https://github.com/bablsoft#org",
       "name": "bablsoft",
       "url": "https://github.com/bablsoft",
-      "logo": "https://accessflow.bablsoft.com/favicon.svg"
+      "logo": "https://accessflow.bablsoft.com/favicon.svg",
+      "description": "bablsoft builds AccessFlow, an open-source access proxy that puts AI review, human approval workflows and a tamper-evident audit log in front of databases, cloud data warehouses and outbound APIs.",
+      "foundingDate": "2026-04",
+      "sameAs": [
+        "https://github.com/bablsoft",
+        "https://github.com/bablsoft/accessflow"
+      ]
     }
   ]
 }
@@ -132,8 +140,9 @@
         <a href="/#how">How it works</a>
         <a href="/#use-cases">Use cases</a>
         <a href="/#install">Install</a>
+        <a href="/#questions">Questions</a>
         <a href="/#roadmap">Roadmap</a>
-        <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+        <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
       </nav>
       <details class="nav-mobile">
         <summary aria-label="Open navigation menu">
@@ -147,8 +156,9 @@
           <a href="/#how">How it works</a>
           <a href="/#use-cases">Use cases</a>
           <a href="/#install">Install</a>
+          <a href="/#questions">Questions</a>
           <a href="/#roadmap">Roadmap</a>
-          <a href="index.html" aria-current="page" class="nav-link-active">Docs</a>
+          <a href="/docs/" aria-current="page" class="nav-link-active">Docs</a>
           <div class="nav-mobile-divider" aria-hidden="true"></div>
           <button class="theme-toggle nav-mobile-theme" type="button" data-theme-toggle aria-label="Switch to light theme" aria-pressed="false">
             <svg class="theme-toggle-icon theme-toggle-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" width="16" height="16" aria-hidden="true">
@@ -218,6 +228,7 @@
         <header class="docs-hero">
           <span class="eyebrow">Documentation</span>
           <h1>End-user workflows.</h1>
+          <p class="docs-updated">Last updated <time datetime="2026-08-03">3 August 2026</time></p>
         </header>
 
 <section id="end-user" class="docs-section">
@@ -228,6 +239,11 @@ <h2>End-user workflows</h2>
             and the bulk-approval review queue that landed in v1.1.
           </p>
 
+          <h3>How does a query get from submitted to executed?</h3>
+          <p>
+            An analyst writes a query in the editor and submits it. AccessFlow parses it, scores its risk with the configured AI provider, and queues it for the reviewers named by the datasource’s review plan. Once approved, AccessFlow executes it over its own pooled connection, applies masking, and returns the rows.
+          </p>
+
           <h3 id="flow-submit">Submitting a query</h3>
           <p>
             <code>/editor</code> hosts the SQL editor: dialect-aware syntax highlighting, schema
@@ -494,13 +510,14 @@ <h3>Product</h3>
             <li><a href="/#how">How it works</a></li>
             <li><a href="/#use-cases">Use cases</a></li>
             <li><a href="/#install">Quick start</a></li>
+            <li><a href="/#questions">Questions</a></li>
             <li><a href="/#roadmap">Roadmap</a></li>
           </ul>
         </div>
         <div class="footer-col">
           <h3>Docs</h3>
           <ul>
-            <li><a href="index.html">User documentation</a></li>
+            <li><a href="/docs/">User documentation</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/02-architecture.md">Architecture</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/04-api-spec.md">REST API</a></li>
             <li><a href="https://github.com/bablsoft/accessflow/blob/main/docs/07-security.md">Security</a></li>
diff --git a/website/index.html b/website/index.html
index a91511fb..41c71796 100644
--- a/website/index.html
+++ b/website/index.html
@@ -64,9 +64,28 @@
         "applicationSubCategory": "Database & API access governance",
         "operatingSystem": "Linux, macOS, Windows (Docker)",
         "softwareVersion": "2.1.1",
+        "datePublished": "2026-04-01",
         "dateModified": "2026-08-03",
         "license": "https://www.apache.org/licenses/LICENSE-2.0",
         "image": "https://accessflow.bablsoft.com/og-image.png",
+        "isAccessibleForFree": true,
+        "softwareRequirements": "Docker and Docker Compose, or Kubernetes with Helm 3. From source: JDK 25 and Node.js 24. Requires PostgreSQL 18 and Redis 8.",
+        "downloadUrl": "https://github.com/bablsoft/accessflow",
+        "installUrl": "https://accessflow.bablsoft.com/#install",
+        "softwareHelp": "https://accessflow.bablsoft.com/docs/",
+        "featureList": [
+          "Full query proxy for SQL, NoSQL and cloud data-warehouse engines",
+          "AI query risk analysis with configurable providers",
+          "Configurable multi-stage review and approval workflows",
+          "Workforce-ready auth — JWT, SAML 2.0, OAuth 2.0 / OIDC, TOTP",
+          "Tamper-evident audit log and signed compliance reports",
+          "Personalized dashboard and weekly digest",
+          "Cloud-native deploy via Docker Compose and Helm",
+          "Infrastructure as Code with a Terraform / OpenTofu provider",
+          "API access governance for REST, SOAP, GraphQL and gRPC",
+          "Data lifecycle — retention, right-to-erasure and pseudonymization",
+          "Request chaining and grouping"
+        ],
         "offers": {
           "@type": "Offer",
           "price": "0",
@@ -80,7 +99,13 @@
         "@id": "https://github.com/bablsoft#org",
         "name": "bablsoft",
         "url": "https://github.com/bablsoft",
-        "logo": "https://accessflow.bablsoft.com/favicon.svg"
+        "logo": "https://accessflow.bablsoft.com/favicon.svg",
+        "description": "bablsoft builds AccessFlow, an open-source access proxy that puts AI review, human approval workflows and a tamper-evident audit log in front of databases, cloud data warehouses and outbound APIs.",
+        "foundingDate": "2026-04",
+        "sameAs": [
+          "https://github.com/bablsoft",
+          "https://github.com/bablsoft/accessflow"
+        ]
       },
       {
         "@type": "WebSite",
@@ -89,6 +114,18 @@
         "name": "AccessFlow",
         "publisher": { "@id": "https://github.com/bablsoft#org" },
         "inLanguage": "en"
+      },
+      {
+        "@type": "WebPage",
+        "@id": "https://accessflow.bablsoft.com/#webpage",
+        "url": "https://accessflow.bablsoft.com/",
+        "name": "AccessFlow — Open-source database & API access governance",
+        "isPartOf": { "@id": "https://accessflow.bablsoft.com/#website" },
+        "about": { "@id": "https://accessflow.bablsoft.com/#software" },
+        "primaryImageOfPage": "https://accessflow.bablsoft.com/og-image.png",
+        "inLanguage": "en",
+        "datePublished": "2026-04-01",
+        "dateModified": "2026-08-03"
       }
     ]
   }
@@ -115,6 +152,7 @@
         <a href="#how">How it works</a>
         <a href="#use-cases">Use cases</a>
         <a href="#install">Install</a>
+        <a href="#questions">Questions</a>
         <a href="#roadmap">Roadmap</a>
         <a href="docs/">Docs</a>
       </nav>
@@ -130,6 +168,7 @@
           <a href="#how">How it works</a>
           <a href="#use-cases">Use cases</a>
           <a href="#install">Install</a>
+          <a href="#questions">Questions</a>
           <a href="#roadmap">Roadmap</a>
           <a href="docs/">Docs</a>
           <div class="nav-mobile-divider" aria-hidden="true"></div>
@@ -1165,6 +1204,74 @@ <h4 class="install-meta-sub">Sizing</h4>
       </div>
     </section>
 
+    <!-- Common questions -->
+    <section class="questions scroll-pad" id="questions">
+      <div class="wrap">
+        <div class="section-head">
+          <span class="eyebrow">Common questions</span>
+          <h2>What people ask before they install it.</h2>
+          <p>Short answers. Each one links onward to the chapter that covers it properly.</p>
+        </div>
+        <div class="qa-grid">
+          <div class="qa-item">
+            <h3>What is a database access proxy?</h3>
+            <p>
+              A database access proxy sits between users and a database and brokers every
+              connection, so nobody holds production credentials directly. Queries arrive at the
+              proxy, which authenticates the person, applies policy, and only then talks to the
+              database on their behalf. AccessFlow adds review and approval to that path.
+            </p>
+          </div>
+          <div class="qa-item">
+            <h3>Which databases does AccessFlow support?</h3>
+            <p>
+              PostgreSQL, MySQL, MariaDB, Oracle, and Microsoft SQL Server over JDBC, plus any
+              other JDBC engine via an uploaded driver. Cloud warehouses: Snowflake, Google
+              BigQuery, Databricks SQL. NoSQL: MongoDB, Couchbase, Redis, Cassandra, ScyllaDB,
+              Elasticsearch, OpenSearch, DynamoDB, and Neo4j. See
+              <a href="/docs/configuration/connectors/">Connectors</a>.
+            </p>
+          </div>
+          <div class="qa-item">
+            <h3>Does AccessFlow store or copy my data?</h3>
+            <p>
+              No. AccessFlow proxies queries and streams results back without persisting them.
+              Its own database stores the query text, the approval decisions, and audit metadata —
+              row counts and timings, not rows. Datasource credentials are AES-256-GCM encrypted,
+              or held in Vault, AWS Secrets Manager, or Azure Key Vault.
+            </p>
+          </div>
+          <div class="qa-item">
+            <h3>How is AccessFlow different from a VPN or a bastion host?</h3>
+            <p>
+              A VPN or bastion controls who reaches the database; neither reads the query. Once
+              you are through, you hold real credentials and can run anything. AccessFlow governs
+              the statement itself — parsing it, scoring its risk, routing it for approval, and
+              masking columns at execution time.
+            </p>
+          </div>
+          <div class="qa-item">
+            <h3>Is AccessFlow free, and what licence is it under?</h3>
+            <p>
+              AccessFlow is free and open source under the Apache 2.0 licence. There is no
+              open-core tier, no paid edition, and no feature held back for a commercial version.
+              You self-host it, and you can fork, audit, and modify it. The full source is on
+              <a href="https://github.com/bablsoft/accessflow">GitHub</a>.
+            </p>
+          </div>
+          <div class="qa-item">
+            <h3>Can AI agents use AccessFlow?</h3>
+            <p>
+              Yes. AccessFlow ships a built-in MCP server, so an AI agent can discover schemas,
+              validate a query, and submit it through the same governance pipeline a human uses.
+              Agents authenticate with scoped API keys and their queries land in the same review
+              queue and the same audit log.
+            </p>
+          </div>
+        </div>
+      </div>
+    </section>
+
     <!-- Roadmap -->
     <section class="roadmap scroll-pad" id="roadmap">
       <div class="wrap">
@@ -1488,6 +1595,7 @@ <h3>Product</h3>
             <li><a href="#how">How it works</a></li>
             <li><a href="#use-cases">Use cases</a></li>
             <li><a href="#install">Quick start</a></li>
+            <li><a href="#questions">Questions</a></li>
             <li><a href="#roadmap">Roadmap</a></li>
           </ul>
         </div>
diff --git a/website/llms.txt b/website/llms.txt
index 68840dae..eb50c472 100644
--- a/website/llms.txt
+++ b/website/llms.txt
@@ -1,14 +1,32 @@
 # AccessFlow
 
-> AccessFlow is an open-source access proxy for SQL and NoSQL databases — PostgreSQL, MySQL, MariaDB, Oracle, SQL Server, MongoDB, Couchbase, Redis, Cassandra, ScyllaDB, Elasticsearch, OpenSearch, Amazon DynamoDB, and Neo4j — plus outbound REST, SOAP, GraphQL, and gRPC APIs. AI-reviewed queries and API calls, configurable approval workflows, and a tamper-evident audit log — self-hosted under Apache 2.0.
+> AccessFlow is an open-source access proxy for SQL databases, cloud data warehouses, NoSQL engines, and outbound APIs — PostgreSQL, MySQL, MariaDB, Oracle, SQL Server, Snowflake, Google BigQuery, Databricks SQL, MongoDB, Couchbase, Redis, Cassandra, ScyllaDB, Elasticsearch, OpenSearch, Amazon DynamoDB, and Neo4j, plus outbound REST, SOAP, GraphQL, and gRPC APIs. AI-reviewed queries and API calls, configurable approval workflows, and a tamper-evident audit log — self-hosted under Apache 2.0.
 
-AccessFlow sits between people (and AI agents) and production data as a full query proxy: a submitted query or API call is parsed and validated, analyzed for risk by a configurable AI provider (Anthropic, OpenAI, Ollama, or any OpenAI-compatible endpoint), routed through multi-stage human approval chains, and only then executed — with schema allow-lists, dynamic data masking, row-level security, and row caps enforced at execution time. Every step lands in an INSERT-only, hash-chained audit log.
+AccessFlow sits between people (and AI agents) and production data as a full query proxy: a submitted query or API call is parsed and validated, analyzed for risk by a configurable AI provider (Anthropic, OpenAI, Ollama, Hugging Face, or any OpenAI-compatible endpoint), routed through multi-stage human approval chains, and only then executed — with schema allow-lists, dynamic data masking, row-level security, and row caps enforced at execution time. Every step lands in an INSERT-only, hash-chained audit log.
+
+Engines are grouped into three families. **Relational** (`RELATIONAL`) covers PostgreSQL, MySQL, MariaDB, Oracle, and Microsoft SQL Server over pooled JDBC, plus any other JDBC-compatible engine via an admin-uploaded driver JAR. **Cloud data warehouses** (`WAREHOUSE`) covers Snowflake, Google BigQuery, and Databricks SQL through native connectors that use each vendor's own authentication model — key-pair JWT, service-account JSON, and personal access tokens respectively — rather than pooled JDBC. **NoSQL** covers the document engines MongoDB and Couchbase (SQL++/N1QL), the key-value engines Redis and Amazon DynamoDB (PartiQL), the wide-column engines Apache Cassandra and ScyllaDB (CQL), the search engines Elasticsearch and OpenSearch (JSON Query DSL), and the graph engine Neo4j (Cypher over Bolt). Every non-JDBC engine ships as an SHA-256-pinned plugin resolved on demand through the connector catalog.
+
+Beyond query review, AccessFlow governs outbound **API access** (REST, SOAP, GraphQL, gRPC) through the same submit → AI → review → execute pipeline, with response masking and data-classification tags. It also provides just-in-time and break-glass access grants, policy-as-code routing, behavioural anomaly detection (UBA), request chaining and grouping, data-lifecycle automation (retention, right-to-erasure, pseudonymization), access recertification campaigns, and signed compliance exports. Authentication is JWT (RS256) with optional SAML 2.0, OAuth 2.0 / OIDC (Google, GitHub, Microsoft, GitLab, Okta, Keycloak, Auth0, and other IdPs), and TOTP.
 
 It is self-hosted (Docker Compose or Helm), ships a built-in MCP server so AI agents can discover schemas and validate and submit queries through the same governance pipeline, and offers a Terraform/OpenTofu provider plus reusable CI actions for infrastructure-as-code management. Source code lives at https://github.com/bablsoft/accessflow.
 
 ## Docs
 
-- [User documentation](https://accessflow.bablsoft.com/docs/): Run and configure AccessFlow — deployment, first-run setup, datasources, review plans, AI configs, SSO, notifications, end-user workflows
+- [Documentation home](https://accessflow.bablsoft.com/docs/): Hub for the operator and admin documentation — install AccessFlow, complete first-run setup, and configure every entity in the review pipeline
+- [Install & first run](https://accessflow.bablsoft.com/docs/install/): Run AccessFlow with Docker Compose, Kubernetes and Helm, or from source, then complete first-time setup with the browser wizard or GitOps bootstrap
+- [Users & roles](https://accessflow.bablsoft.com/docs/configuration/users-roles/): Configure organizations and quotas, invite users, assign RBAC roles, group them, and grant just-in-time or break-glass access
+- [Datasources](https://accessflow.bablsoft.com/docs/configuration/datasources/): Add governed datasources, tag sensitive columns, apply masking and row-level security policies, upload JDBC drivers, and watch pool health
+- [Connectors](https://accessflow.bablsoft.com/docs/configuration/connectors/): Install SQL, NoSQL and data-warehouse engine connectors from the catalog, and register outbound REST, SOAP, GraphQL and gRPC API connectors
+- [Review workflows](https://accessflow.bablsoft.com/docs/configuration/review-workflows/): Build multi-stage approval chains with review plans, automate decisions with policy-as-code routing, and run access recertification campaigns
+- [AI](https://accessflow.bablsoft.com/docs/configuration/ai/): Configure AI providers for query risk analysis, add a RAG knowledge base, trace prompts with Langfuse, and enable behavioural anomaly detection
+- [Auth & SSO](https://accessflow.bablsoft.com/docs/configuration/auth/): Connect to your identity provider with OAuth 2.0 / OIDC or SAML 2.0 single sign-on — Google, GitHub, Microsoft, GitLab, Okta, Keycloak and more
+- [Notifications](https://accessflow.bablsoft.com/docs/configuration/notifications/): Route review and audit events to email, Slack, Discord, Telegram, Teams, PagerDuty, ServiceNow, Jira and signed webhooks, and configure system SMTP
+- [Audit & compliance](https://accessflow.bablsoft.com/docs/configuration/audit-compliance/): Read the tamper-evident audit log, generate signed compliance exports, run retention and right-to-erasure policies, and use the personalized dashboard
+- [End-user workflows](https://accessflow.bablsoft.com/docs/workflows/): How analysts submit queries and API calls, draft SQL from natural language, schedule runs, and how reviewers approve or reject them
+- [Infrastructure as Code](https://accessflow.bablsoft.com/docs/iac/): Manage AccessFlow declaratively with the Terraform / OpenTofu provider, service-account API keys, and the reusable GitHub Actions and GitLab CI templates
+
+## Engineering reference
+
 - [Project README](https://raw.githubusercontent.com/bablsoft/accessflow/main/README.md): Project overview and quick start
 - [Overview](https://raw.githubusercontent.com/bablsoft/accessflow/main/docs/01-overview.md): Problem statement, goals, non-goals, value proposition
 - [Architecture](https://raw.githubusercontent.com/bablsoft/accessflow/main/docs/02-architecture.md): Subsystems, technology stack, request flow
@@ -23,7 +41,7 @@ It is self-hosted (Docker Compose or Helm), ships a built-in MCP server so AI ag
 - [Roadmap](https://raw.githubusercontent.com/bablsoft/accessflow/main/docs/12-roadmap.md): Milestones, contribution path
 - [MCP server](https://raw.githubusercontent.com/bablsoft/accessflow/main/docs/13-mcp.md): Stateless tool surface for AI agents — discover, validate, sample, submit; API keys
 - [Connectors](https://raw.githubusercontent.com/bablsoft/accessflow/main/docs/14-connectors.md): Declarative connector catalog, manifests, install lifecycle
-- [Engine-plugin SDK](https://raw.githubusercontent.com/bablsoft/accessflow/main/docs/15-engine-sdk.md): Authoring guide for native NoSQL engine plugins
+- [Engine-plugin SDK](https://raw.githubusercontent.com/bablsoft/accessflow/main/docs/15-engine-sdk.md): Authoring guide for native NoSQL and data-warehouse engine plugins
 - [Infrastructure as Code](https://raw.githubusercontent.com/bablsoft/accessflow/main/docs/16-iac.md): Terraform/OpenTofu provider, CI Actions, service-account keys, registry publishing
 - [API Access Governance](https://raw.githubusercontent.com/bablsoft/accessflow/main/docs/17-api-governance.md): Govern outbound REST/SOAP/GraphQL/gRPC calls — connectors, schema ingestion, permissions
 
@@ -32,4 +50,6 @@ It is self-hosted (Docker Compose or Helm), ships a built-in MCP server so AI ag
 - [GitHub repository](https://github.com/bablsoft/accessflow): Source code, issues, releases (Apache 2.0)
 - [Agent rulebook](https://raw.githubusercontent.com/bablsoft/accessflow/main/CLAUDE.md): Authoritative implementation rules for AI agents contributing to the codebase
 - [Install / quick start](https://accessflow.bablsoft.com/#install): Docker Compose, Helm, and from-source install commands
+- [Common questions](https://accessflow.bablsoft.com/#questions): Short answers to the most-asked questions about AccessFlow
 - [Helm chart repository](https://bablsoft.github.io/accessflow): Published Helm chart index for Kubernetes installs
+- [Sitemap](https://accessflow.bablsoft.com/sitemap.xml): Every indexable URL on this site
diff --git a/website/styles.css b/website/styles.css
index a2f6b18c..92c7c6ed 100644
--- a/website/styles.css
+++ b/website/styles.css
@@ -1353,6 +1353,40 @@ section + section { border-top: 1px solid var(--line); }
   margin-top: auto;
 }
 
+/* common questions */
+
+.qa-grid {
+  display: grid;
+  grid-template-columns: repeat(2, 1fr);
+  gap: 12px;
+}
+
+.qa-item {
+  border: 1px solid var(--line);
+  border-radius: var(--radius);
+  padding: 24px;
+  background: var(--bg-1);
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  transition: border-color 0.15s, background 0.15s;
+}
+.qa-item:hover {
+  border-color: var(--line-strong);
+  background: var(--bg-2);
+}
+
+.qa-item h3 {
+  font-size: 16px;
+  font-weight: 500;
+  letter-spacing: -0.01em;
+}
+.qa-item p {
+  font-size: 14px;
+  color: var(--fg-mute);
+  line-height: 1.65;
+}
+
 /* cta + footer */
 
 .big-cta {
@@ -1505,6 +1539,7 @@ footer {
   .hero { padding: 64px 0 56px; }
   .feat-grid { grid-template-columns: 1fr; }
   .docs-grid { grid-template-columns: 1fr; }
+  .qa-grid { grid-template-columns: 1fr; }
   .roadmap-track { grid-template-columns: 1fr; }
   .footer-grid { grid-template-columns: 1fr 1fr; gap: 32px; }
   .footer-bar { flex-direction: column; gap: 16px; }
@@ -1640,6 +1675,14 @@ img, table, pre { max-width: 100%; }
   max-width: 70ch;
 }
 
+.docs-hero p.docs-updated {
+  color: var(--fg-mute);
+  font-family: var(--mono);
+  font-size: 13px;
+  letter-spacing: 0.01em;
+  margin-top: -8px;
+}
+
 .docs-hero a,
 .docs-content a {
   color: var(--accent);