diff --git a/docs/operations.md b/docs/operations.md
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -152,7 +152,10 @@
 - `ZDS_PERMISSIONED_DATA`: set to `true` to opt into experimental
   permissioned-data routes. Default: disabled. ZDS exposes protocol reads and
   writes under `com.atproto.space.*`, and baseline PDS-managed space management
-  under `com.atproto.simplespace.*`. The implementation remains experimental:
+  under `com.atproto.simplespace.*`, tracking the lexicons published for the
+  [spaces alpha](https://atproto.com/blog/atproto-spaces-alpha). Enable it if
+  residents want to use alpha apps such as
+  [Bulletin](https://bulletin.my). The implementation remains experimental:
   reader/group semantics should stay in application policy, while `simplespace`
   only provides the small required baseline. Use `just smoke-permissioned` for
   the experimental smoke lane.
diff --git a/docs/permissioned-data.md b/docs/permissioned-data.md
--- a/docs/permissioned-data.md
+++ b/docs/permissioned-data.md
@@ -134,9 +134,13 @@
 The generic PDS implementation of that method returns `authorized: false`;
 policy services replace it with their own application-layer decision.
 
-`appAccess` follows the proposal's lexicon-union wire shape:
-`{"$type":"com.atproto.simplespace.defs#open"}` or
-`{"$type":"com.atproto.simplespace.defs#allowList","allowed":[...]}`.
+`policy` and `appAccess` use the lexicon-union wire shape on every
+`simplespace` route: `{"$type":"com.atproto.simplespace.defs#memberListPolicy"}`,
+`{"$type":"com.atproto.simplespace.defs#managingAppPolicy","managingApp":"did:…#svc"}`,
+`{"$type":"com.atproto.simplespace.defs#open"}`, or
+`{"$type":"com.atproto.simplespace.defs#allowList","allowed":[...]}`. A
+`managingApp` must be a DID with an optional service fragment; anything else is
+`UnsupportedPolicy`.
 Delegation tokens identify the user, not the app. For allow-list spaces, ZDS
 verifies the separately supplied `clientAttestation` against the client's
 published metadata and JWKS before using its `client_id`. Credential issuance
diff --git a/docs/references.md b/docs/references.md
--- a/docs/references.md
+++ b/docs/references.md
@@ -136,6 +136,19 @@
 PDS moves. When migration behavior is confusing, check this alongside the
 official PDS before assuming what key material should be stored or exposed.
 
+### spaces alpha (permissioned data)
+
+Links:
+[announcement](https://atproto.com/blog/atproto-spaces-alpha),
+[permissioned-data branch](https://github.com/bluesky-social/atproto/tree/permissioned-data),
+[Bulletin](https://github.com/bluesky-social/bulletin)
+
+The lexicons under `lexicons/com/atproto/{space,simplespace}` on the branch are
+the contract for `com.atproto.space.*` and `com.atproto.simplespace.*`; ZDS is
+listed in the announcement as a compatible PDS. Bulletin is the smallest real
+client and the fastest interop check: sign in from a zds account and create a
+board. See [permissioned data](permissioned-data.md) for the ZDS-side notes.
+
 ## test and workload references
 
 - [alice.mosphere.at/atproto-smoke](https://tangled.org/alice.mosphere.at/atproto-smoke):