diff --git a/risc0-selective-privacy-poc/core/src/lib.rs b/risc0-selective-privacy-poc/core/src/lib.rs
index 853ab40..bde57f9 100644
--- a/risc0-selective-privacy-poc/core/src/lib.rs
+++ b/risc0-selective-privacy-poc/core/src/lib.rs
@@ -61,7 +61,8 @@ pub fn bytes_to_words(bytes: &[u8; 32]) -> [u32; 8] {
 /// - does not change account addresses
 /// - does not change account nonces
 /// - does not change the `program_owner` field
-/// - only reduces the balance of accounts it owns
+/// - only reduces the balance of accounts it owns and for which authentication was provided
+///   (**NOTE**: this authentication check is **not** included in this proof of concept)
 /// - preserves the total token supply across all accounts
 ///
 /// This function does **not** check that the output accounts are the result of correctly