diff --git a/content/en/docs/community/_index.md b/content/en/docs/community/_index.md
index a690497a..b4cbcba1 100644
--- a/content/en/docs/community/_index.md
+++ b/content/en/docs/community/_index.md
@@ -47,6 +47,7 @@ We host [regular community meetings](https://github.com/score-spec/spec?tab=read
 
 ## Read external blog posts about Score
 
+- [Anatomy of a score.yaml: How Resolution Actually Works](https://rootcause.hashnode.dev/anatomy-of-a-score-yaml-how-resolution-actually-works)
 - [Score + Docker Compose to deploy your local LLM models](https://medium.com/google-cloud/score-docker-compose-to-deploy-your-local-llm-models-10aff89686ce)
 - [Unifying the Inner & Outer Loops to Bridge the Gaps between Devs & Ops with Containers + Microcks + Score](https://itnext.io/unifying-inner-outer-loops-to-bridge-the-gaps-between-devs-ops-with-containers-microcks-d28603342f4b)
 - [Generate your Backstage software catalog files with Score](https://medium.com/@mabenoit/generate-your-backstage-software-catalog-files-with-score-b62aa33e8ecc)
diff --git a/content/en/docs/score implementation/score-compose/resources-provisioners.md b/content/en/docs/score implementation/score-compose/resources-provisioners.md
index c2232bc3..2b4ef18e 100644
--- a/content/en/docs/score implementation/score-compose/resources-provisioners.md	
+++ b/content/en/docs/score implementation/score-compose/resources-provisioners.md	
@@ -17,6 +17,16 @@ When running `score-compose generate`, all `*.provisioners.yaml` files are loade
 
 To list the provisioners available from the `.score-compose` directory, run the `score-compose provisioners list` command.
 
+## Resource identity
+
+Every resource gets an identity before it gets a provisioner. Before a provisioner can claim a resource, `score-compose` has to decide what that resource is. The identity comes from four things you write directly: `type`, an optional `class`, an optional `id`, and the workload name, combined into a resource UID shaped like:
+
+`type.class#workload_name.resource_name`
+
+Skip `class` and it defaults to `default`. A plain `postgres` resource named `db` inside a workload called `checkout` becomes `postgres.default#checkout.db`. You'll run into this exact string the first time a resource has no matching provisioner, since it shows up directly in the error message.
+
+`id` is the interesting field. Leave it unset and a resource is scoped to its own workload. Set it, and two resources in two different workloads with matching `type`, `class`, and `id` are treated as one resource, provisioned once, with both workloads reading the same outputs. There's no separate "shared resource" primitive in the spec. It's identity matching, nothing more.
+
 ## Default provisioners
 
 | Type                | Class | Params                 | Output                                                                                               | Description                                                                             |
diff --git a/content/en/docs/score implementation/score-k8s/resources-provisioners.md b/content/en/docs/score implementation/score-k8s/resources-provisioners.md
index e9cd6900..61bdb901 100644
--- a/content/en/docs/score implementation/score-k8s/resources-provisioners.md	
+++ b/content/en/docs/score implementation/score-k8s/resources-provisioners.md	
@@ -17,6 +17,16 @@ When running `score-k8s generate`, all `*.provisioners.yaml` files are loaded in
 
 To list the provisioners available from the `.score-k8s` directory, run the `score-k8s provisioners list` command.
 
+## Resource identity
+
+Every resource gets an identity before it gets a provisioner. Before a provisioner can claim a resource, `score-k8s` has to decide what that resource is. The identity comes from four things you write directly: `type`, an optional `class`, an optional `id`, and the workload name, combined into a resource UID shaped like:
+
+`type.class#workload_name.resource_name`
+
+Skip `class` and it defaults to `default`. A plain `postgres` resource named `db` inside a workload called `checkout` becomes `postgres.default#checkout.db`. You'll run into this exact string the first time a resource has no matching provisioner, since it shows up directly in the error message.
+
+`id` is the interesting field. Leave it unset and a resource is scoped to its own workload. Set it, and two resources in two different workloads with matching `type`, `class`, and `id` are treated as one resource, provisioned once, with both workloads reading the same outputs. There's no separate "shared resource" primitive in the spec. It's identity matching, nothing more.
+
 ## Default provisioners
 
 | Type           | Class | Params                 | Output                                                                                               | Description                                                                             |