Document deployment-managed cache permissions

docs/config.md

@@ -69,6 +69,9 @@ Built-in defaults are:
 
 An empty cache directory in YAML deliberately selects the corresponding
 per-user root. An explicit empty output or debug directory is invalid.
+Selecting a chunk-plan or checkpoint directory does not configure filesystem
+access policy. Cache permissions come from deployment provisioning, process
+umask, setgid inheritance, and default ACLs; see [Operations](operations.md#cache-provisioning).
 
 ## PromptKit Profiles
 
@@ -200,6 +203,8 @@ through **total_llm**. When omitted, it is recalculated from the effective
 **cache.chunk_plans.mode** accepts **auto**, **bypass**, or **refresh**.
 **cache.checkpoints.enabled** is a boolean. The CLI can override the output
 directory and chunk-plan mode for one run; see [CLI reference](cli.md#run).
+Cache directory fields select only locations; Notarius has no cache permission
+field or environment override.
 
 ## Pipelines