diff --git a/.devcontainer/workshop/app-instructions.md b/.devcontainer/workshop/app-instructions.md
index 646b11f..2fb6b2d 100644
--- a/.devcontainer/workshop/app-instructions.md
+++ b/.devcontainer/workshop/app-instructions.md
@@ -12,10 +12,12 @@ Never print secrets, show a file that holds one, or ask the user to paste one in
 ## Setup and specs
 - After Compile, set up the app, build its assets and run its specs as its README says, before the
   first preview. In that first run, a spec that fails through behavior the README's
-  **Behavior to write** lists is work to do: write that behavior until its specs pass. A stub
-  raises `NotImplementedError`, and a deletion outcome First Draft left out fails its spec with
-  `RecordNotDestroyed`. Any other failure in that run is a First Draft defect: tell the user which
-  spec failed and its error. Never edit or delete a generated spec to make it pass.
+  **Behavior to write** lists is work to do: write that behavior until its specs pass. A stubbed
+  scope raises `NotImplementedError`, a stubbed Policy rule returns `false`, and a deletion outcome
+  First Draft left out fails its spec with `RecordNotDestroyed`. Write every item that section
+  lists, including a denying rule no failing spec names. Any other failure in that run is a First
+  Draft defect: tell the user which spec failed and its error. Never edit or delete a generated
+  spec to make it pass.
 - System specs need a Selenium browser that this Codespace does not start by itself. From the app's
   root, start it before every spec run (all specs, one spec file, or `bin/ci`) and stop it
   afterward, even when specs fail. Run these lines as one command, with your spec command in place