diff --git a/README.md b/README.md
index 085e2fd..cd2b615 100644
--- a/README.md
+++ b/README.md
@@ -80,6 +80,10 @@ The bridge between your plugin and the Paca host. Available via `Init(ctx)`:
 - `ctx.Route(method, path, handler)` — register an HTTP endpoint
 - `ctx.On(event, handler)` — subscribe to a core platform event
 
+Route-level host middleware (for example `authn`, `requireFreshPassword`,
+`requirePermissions`) is configured in `plugin.json` under
+`backend.routes[].middlewares`.
+
 ### `DB`
 Typed SQL execution. The host enforces row-level scoping; you can only see data for the project where the plugin is enabled.
 - `db.Query(sql, args...)` — execute a read query; returns `[]map[string]any`