diff --git a/Security-Overview.md b/Security-Overview.md
index 984b68c..e0966d0 100644
--- a/Security-Overview.md
+++ b/Security-Overview.md
@@ -124,3 +124,21 @@ If `jwt.filer_signing.read.key` is configured: When sending GET or HEAD requests
 
 The S3 API Gateway reads the above JWT keys and sends authenticated
 HTTP requests to the filer.
+
+### JWT Scoping
+
+Starting with recent versions (PR #8014), the Filer HTTP JWT can optionally include claims to restrict access to specific paths and HTTP methods.
+
+*   `allowed_prefixes`: A list of path prefixes. If present, the request path must match at least one of these prefixes.
+*   `allowed_methods`: A list of HTTP methods (e.g., "GET", "POST"). If present, the request method must match one of these methods.
+
+Example JWT payload:
+```json
+{
+  "exp": 17000,
+  "allowed_prefixes": ["/hls/movie123/", "/subtitles/movie123/"],
+  "allowed_methods": ["GET", "HEAD"]
+}
+```
+This is useful for generating short-lived, scoped tokens for direct client access (e.g., for downloading content) without exposing global read/write permissions.
+