diff --git a/src/config/acl.rs b/src/config/acl.rs
index c5d5dd5f..d31c7a85 100644
--- a/src/config/acl.rs
+++ b/src/config/acl.rs
@@ -47,7 +47,11 @@ constnamemap! {
 }
 
 
+/// Admin always has all privileges. It can do everything except a few actions
+/// which are limited to the 'root@pam` superuser
 pub const ROLE_ADMIN: u64 = std::u64::MAX;
+
+/// NoAccess can be used to remove privileges from specific paths
 pub const ROLE_NO_ACCESS: u64 = 0;
 
 pub const ROLE_AUDIT: u64 =