diff --git a/docs/reference/machine-policy.md b/docs/reference/machine-policy.md
index 9e679bb..c753cf9 100644
--- a/docs/reference/machine-policy.md
+++ b/docs/reference/machine-policy.md
@@ -45,7 +45,7 @@ When several layers set a key, the first of these wins: machine policy, then the
 | `server.allowOther` | bool | `false` blocks accounts on any other server. Scheme, host, port and path must match `server.url`, so `https://api.acme.com` does not admit `http://acme.com` or `https://www.acme.com` |
 | `server.previousUrls` | list of URLs | Addresses `server.url` used to have. Locked only. See [Moving the server](#moving-the-server) |
 | `sshConfig.import` | bool | The `~/.ssh/config` import switch |
-| `enrollment.token` | string | An [enrolment token](../teams/enrollment-tokens.md). Locked only, never under `defaults`. Write it with `voltius-cli enroll`. Voltius asks people on the machine to sign in to the token's team |
+| `enrollment.token` | string | An [enrolment token](../teams/enrollment-tokens.md). Locked only, never under `defaults`. Write it with `voltius-cli enroll`. Voltius asks people on the machine to sign in to the token's team, and the team's policy applies to every account on the machine. See [Team policy on enrolled machines](../teams/enrollment-tokens.md#team-policy-on-enrolled-machines) |
 | `plugins.install` | list of plugin ids | Locked: installed and can't be removed. Default: installed once, users may remove it |
 | `plugins.enabled` / `plugins.disabled` | list of plugin ids | Forced on / off (locked), or turned on / off once (default) |
 | `plugins.allowInstall` | bool | `false`: users can only install plugins listed in `plugins.install`. Updates of installed plugins still work |
diff --git a/docs/teams/enrollment-tokens.md b/docs/teams/enrollment-tokens.md
index c133d32..b675187 100644
--- a/docs/teams/enrollment-tokens.md
+++ b/docs/teams/enrollment-tokens.md
@@ -37,9 +37,9 @@ If the server can't send email, it can't confirm that a person owns an address.
 
 ## Rotating and revoking
 
-Creating a token again rotates it. The old token stops working at once, so update wherever you handed it out. Requests already waiting stay open and you can still decide them. Rotating keeps a future expiry.
+Creating a token again rotates it. The old token stops working for new joins at once, so update wherever you handed it out. Machines already enrolled with the old token keep getting the team's policy. Requests already waiting stay open and you can still decide them. Rotating keeps a future expiry.
 
-**Revoke** removes the token without replacing it. Revoking works even if the team's plan has lapsed.
+**Revoke** removes the token without replacing it. Machines enrolled with it stop getting the team's policy. People who already joined stay members. Revoking works even if the team's plan has lapsed.
 
 The section also shows when the token was last used and how many people are waiting or have joined through it.
 
@@ -86,6 +86,18 @@ sudo voltius-cli enroll "vte1.…"
 
 Rotating or revoking the token doesn't remove it from machines. Run `voltius-cli enroll` with the new token, or `voltius-cli enroll --remove`.
 
+## Team policy on enrolled machines
+
+On a machine whose [machine policy](../reference/machine-policy.md) has `enrollment.token`, the team's [policy](team-policy.md) applies to every account on that machine: signed out, offline accounts, personal accounts and accounts on other servers. People can't drop the team's locks by switching accounts.
+
+- Voltius fetches the policy from your server with the token, when it starts and about every 15 minutes while it is open. Changes you save in **Members → Security → Device policy** reach enrolled machines within 15 minutes.
+- It keeps applying offline, from the last policy it received.
+- The enrolling team ranks first if a person's own teams set the same key.
+- Rotating the token keeps machines enrolled with the old one managed. Revoking it stops their team policy. An expired token only stops new joins; machines keep getting the policy.
+- The policy keeps applying if the team's plan lapses.
+
+To stop managing a machine, remove `enrollment.token` from it with `voltius-cli enroll --remove`, or remove it from the MDM configuration. A token pasted in the app or opened from a link only joins that person; it doesn't put the machine under the team's policy.
+
 ## What people see
 
 **First launch.** On a machine with a token, a new person sees **Sign in to <your team>** instead of the generic welcome screen. The server is your organization's and can't be changed here. They create an account or sign in with their email, and the join request is sent. If the token has domains, the form says which email to use. **Skip for now** is always there.
diff --git a/docs/teams/team-policy.md b/docs/teams/team-policy.md
index 68ef6d3..e4395e1 100644
--- a/docs/teams/team-policy.md
+++ b/docs/teams/team-policy.md
@@ -50,7 +50,7 @@ Older Voltius versions apply only these app-lock settings, and only a timeout wr
 
 Locked settings show **Managed by** followed by the team name. Range-limited settings stay editable, with options outside the range greyed out.
 
-The policy applies only while that team's account is the active account. It stops when a member switches to a personal account or signs out, and returns when they switch back. It keeps applying offline, from the last policy the app received. It applies to everyone in the team, owners and admins included.
+The policy applies only while that team's account is the active account. It stops when a member switches to a personal account or signs out, and returns when they switch back. On a machine [enrolled with the team's token](enrollment-tokens.md#team-policy-on-enrolled-machines), it applies to every account instead. It keeps applying offline, from the last policy the app received. It applies to everyone in the team, owners and admins included.
 
 ## Precedence