diff --git a/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/TrueNASCredentialSlot.tsx b/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/TrueNASCredentialSlot.tsx
index 47dfd2d43..3355b6375 100644
--- a/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/TrueNASCredentialSlot.tsx
+++ b/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/TrueNASCredentialSlot.tsx
@@ -388,6 +388,7 @@ export const TrueNASCredentialSlot: Component<TrueNASCredentialSlotProps> = (pro
             class={buttonClass}
             onClick={() => void props.state.previewCurrentForm()}
             disabled={props.state.saving() || props.state.testing() || props.state.previewing()}
+            title="Show the resources Pulse would ingest from this connection without saving or starting polling."
           >
             {props.state.previewing() ? 'Previewing…' : 'Preview impact'}
           </button>
diff --git a/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/VMwareCredentialSlot.tsx b/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/VMwareCredentialSlot.tsx
index 9100b928c..4f87a5b85 100644
--- a/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/VMwareCredentialSlot.tsx
+++ b/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/VMwareCredentialSlot.tsx
@@ -337,6 +337,7 @@ export const VMwareCredentialSlot: Component<VMwareCredentialSlotProps> = (props
             disabled={
               props.state.saving() || props.state.testing() || props.state.previewing()
             }
+            title="Show the resources Pulse would ingest from this connection without saving or starting polling."
           >
             {props.state.previewing() ? 'Previewing…' : 'Preview impact'}
           </button>
diff --git a/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx b/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx
index a12cdd98b..21126aeba 100644
--- a/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx
+++ b/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx
@@ -291,6 +291,33 @@ export const InfrastructureInstallerSection: Component<InfrastructureInstallerSe
             </p>
           </div>
 
+          <div class="ml-6 rounded-md border border-blue-200 bg-blue-50 p-3 dark:border-blue-800 dark:bg-blue-900">
+            <p class="mb-2 text-sm font-semibold text-blue-800 dark:text-blue-200">
+              What this token authorizes:
+            </p>
+            <ul class="space-y-1 text-xs text-blue-700 dark:text-blue-300">
+              <li class="flex items-start">
+                <span class="mr-2 mt-0.5 text-emerald-500">✓</span>
+                <span>Pulse Agent on this host reports its own telemetry to this Pulse instance.</span>
+              </li>
+              <li class="flex items-start">
+                <span class="mr-2 mt-0.5 text-emerald-500">✓</span>
+                <span>
+                  Read-only by default. Assistant control and host shell stay off until you opt in
+                  per host from <span class="font-medium">Settings → Infrastructure</span>.
+                </span>
+              </li>
+              <li class="flex items-start">
+                <span class="mr-2 mt-0.5 text-emerald-500">✓</span>
+                <span>
+                  Revoke the token any time from{' '}
+                  <span class="font-medium">Settings → Infrastructure → Tokens</span>; the agent
+                  stops reporting immediately.
+                </span>
+              </li>
+            </ul>
+          </div>
+
           <div class="flex gap-2">
             <input
               type="text"
@@ -301,7 +328,7 @@ export const InfrastructureInstallerSection: Component<InfrastructureInstallerSe
                   void state.handleGenerateToken();
                 }
               }}
-              placeholder="Token name (optional)"
+              placeholder="Token name (optional label for your audit log)"
               class="flex-1 rounded-md border border-border bg-surface px-3 py-2 text-sm text-base-content shadow-sm focus:border-blue-500 focus:outline-none focus:ring-2 focus:ring-blue-200 dark:focus:border-blue-400 dark:focus:ring-blue-900"
             />
             <button
diff --git a/frontend-modern/src/components/Settings/NodeModalMonitoringSection.tsx b/frontend-modern/src/components/Settings/NodeModalMonitoringSection.tsx
index 597d448c1..0cf3a682c 100644
--- a/frontend-modern/src/components/Settings/NodeModalMonitoringSection.tsx
+++ b/frontend-modern/src/components/Settings/NodeModalMonitoringSection.tsx
@@ -68,7 +68,7 @@ export const NodeModalMonitoringSection: Component<NodeModalMonitoringSectionPro
       <Show when={modalProps.nodeType === 'pve'}>
         <div class="space-y-3">
           <SectionHeader
-            title="Data collection"
+            title="Collection scope"
             size="sm"
             class="mb-1"
             titleClass="text-base-content"
@@ -233,7 +233,7 @@ export const NodeModalMonitoringSection: Component<NodeModalMonitoringSectionPro
       <Show when={modalProps.nodeType === 'pbs'}>
         <div class="space-y-3">
           <SectionHeader
-            title="Data collection"
+            title="Collection scope"
             size="sm"
             class="mb-1"
             titleClass="text-base-content"
@@ -329,7 +329,7 @@ export const NodeModalMonitoringSection: Component<NodeModalMonitoringSectionPro
       <Show when={modalProps.nodeType === 'pmg'}>
         <div class="space-y-3">
           <SectionHeader
-            title="Data collection"
+            title="Collection scope"
             size="sm"
             class="mb-1"
             titleClass="text-base-content"