diff --git a/policies/README.md b/policies/README.md
index 943169a..e4efe55 100644
--- a/policies/README.md
+++ b/policies/README.md
@@ -20,6 +20,13 @@ existing objects.
 | `disallow-default-namespace` | Supplemental | Blocks common application resources from being created in `default`, which makes namespace ownership explicit. |
 | `disallow-host-network` | 5.2.3 and 5.2.5 | Rejects host PID, host network, and host IPC access. |
 
+The default-namespace policy intentionally excludes ConfigMaps and Secrets.
+Those objects are supporting data, not application entrypoints, and blocking
+them alone would not prevent a workload from being installed. Keeping them out
+also avoids adding broad read permissions for Secret data to Kyverno's reports
+controller. Applications should create these objects in the same explicitly
+named namespace as the workloads that consume them.
+
 The CIS benchmark includes manual checks and platform-specific exceptions.
 The mapping above describes the control objective each policy supports, not a
 claim that one Kyverno rule implements the entire benchmark control.
diff --git a/policies/kyverno/disallow-default-namespace.yaml b/policies/kyverno/disallow-default-namespace.yaml
index dfcb8e9..d8969c8 100644
--- a/policies/kyverno/disallow-default-namespace.yaml
+++ b/policies/kyverno/disallow-default-namespace.yaml
@@ -8,6 +8,9 @@ metadata:
     policies.kyverno.io/severity: medium
     # Supplemental namespace-isolation control. This is not a one-to-one CIS control.
     policies.kyverno.io/cis-control: "supplemental"
+    # ConfigMaps and Secrets are intentionally excluded. They are supporting
+    # data rather than application entrypoints, and matching Secrets would also
+    # require broader Kyverno reports-controller read permissions.
 spec:
   validationFailureAction: Enforce
   background: false