diff --git a/proposal.md b/proposal.md
index 2545d6d..7ab5e7d 100644
--- a/proposal.md
+++ b/proposal.md
@@ -58,10 +58,25 @@ An application writes these records using an OAuth session for the group DID. Th
 Authorization uses a two-sided OAuth flow:
 
 1. The application starts an atproto OAuth flow for the group DID, requesting the scopes it needs.
-2. The group host authenticates the user by acting as an OAuth client to their personal PDS in a second flow.
+2. The group host authenticates the user by acting as an OAuth client to their personal PDS in a second flow (requiring only authentication).
 3. The group host checks the user's roles and presents consent for the allowed scopes, as specified in the relevant `access` records.
 4. On approval, the application receives an OAuth session for the group DID.
 
+```text
+Application                     Group host                       User's PDS
+    |                                |                                |
+    |--- OAuth for group DID ------->|                                |
+    |                                |--- OAuth for user DID -------->|
+    |                                |      (authentication only)     |
+    |                                |                          User signs in
+    |                                |<-- Personal OAuth session -----|
+    |                                |                                |
+    |                   Check roles + user consent                    |
+    |                                |                                |
+    |<-- Group OAuth session --------|                                |
+    |                                |                                |
+```
+
 Applications can use these sessions in two ways:
 
 - **Per-user sessions.** Each user authorizes a session for their own actions, using the scopes allowed by their roles. This suits personal tools and independent clients.