diff --git a/src/content/docs/reference/policies/ContentAnalysis.mdx b/src/content/docs/reference/policies/ContentAnalysis.mdx
index 71b821f..da70e18 100644
--- a/src/content/docs/reference/policies/ContentAnalysis.mdx
+++ b/src/content/docs/reference/policies/ContentAnalysis.mdx
@@ -58,6 +58,27 @@ Configure Firefox to use an agent for Data Loss Prevention (DLP) that is compati
 
 <PolicyExample policy="ContentAnalysis" />
 
+### Connecting to a DLP agent
+
+Take the pipe name and agent name from your DLP vendor's documentation.
+`ClientSignature` makes Firefox check that the agent's program is signed by your vendor before it sends the agent any data, so another program can't pose as the agent.
+The value must exactly match the organization name on the agent's code-signing certificate.
+
+If Firefox can't reach the agent, or the agent doesn't respond in time, the operation is denied, because `DefaultResult` and `TimeoutResult` both default to `0`:
+
+```json
+{
+  "policies": {
+    "ContentAnalysis": {
+      "Enabled": true,
+      "AgentName": "Example DLP",
+      "PipePathName": "example_dlp_agent",
+      "ClientSignature": "Example DLP Inc."
+    }
+  }
+}
+```
+
 ## Windows (GPO)
 
 ```
diff --git a/src/content/docs/reference/policies/DataLossPrevention.mdx b/src/content/docs/reference/policies/DataLossPrevention.mdx
index 29336ca..6cf16d1 100644
--- a/src/content/docs/reference/policies/DataLossPrevention.mdx
+++ b/src/content/docs/reference/policies/DataLossPrevention.mdx
@@ -35,6 +35,58 @@ Only one DLP service can be active:
 
 <PolicyExample policy="DataLossPrevention" />
 
+### Blocking uploads to cloud storage
+
+This rule blocks file uploads to specific cloud storage services, with a message for where to put files instead.
+`FileUpload` covers files chosen in the file picker and files dragged onto the page.
+A rule only takes effect when `Enabled` is `true`:
+
+```json
+{
+  "policies": {
+    "DataLossPrevention": {
+      "Rules": [
+        {
+          "Name": "block-cloud-uploads",
+          "Enabled": true,
+          "Actions": ["FileUpload"],
+          "Domains": ["drive.google.com", "www.dropbox.com", "wetransfer.com"],
+          "Type": "block",
+          "Message": "Upload work files to the company file share instead."
+        }
+      ]
+    }
+  }
+}
+```
+
+### Blocking clipboard paste in AI chat applications
+
+This rule blocks pasting text into specific AI chat services, with a message pointing users to an approved tool.
+Unlike the warning in the first example, users can't choose to continue (`"Type": "block"`).
+Blocking also applies when a user pastes into one of these services as the AI chatbot in the Firefox sidebar:
+
+```json
+{
+  "policies": {
+    "DataLossPrevention": {
+      "Rules": [
+        {
+          "Name": "block-ai-paste",
+          "Enabled": true,
+          "Actions": ["TextPaste"],
+          "Domains": ["chatgpt.com", "claude.ai", "gemini.google.com", "copilot.microsoft.com"],
+          "Type": "block",
+          "Message": "Pasting into AI chat services isn't allowed. Use the company AI assistant instead."
+        }
+      ]
+    }
+  }
+}
+```
+
+To also block attaching files, you can add `FileUpload` to `Actions`.
+
 ## Compatibility
 
 <PolicyCompat policy="DataLossPrevention" />
diff --git a/src/content/docs/reference/policies/Watermark.mdx b/src/content/docs/reference/policies/Watermark.mdx
index c3b4ec0..272657d 100644
--- a/src/content/docs/reference/policies/Watermark.mdx
+++ b/src/content/docs/reference/policies/Watermark.mdx
@@ -29,6 +29,42 @@ By default it shows the signed-in user's email address with a timestamp below it
 
 <PolicyExample policy="Watermark" />
 
+### Watermarking internal sites
+
+When only `Match` is set, the watermark shows the email address of the user signed in to Firefox Enterprise, with a UTC timestamp below it, like `2026-11-05T09:30:00Z`.
+The timestamp is the time the page loaded, or the time it was printed.
+
+Each match pattern needs a path (like an exact match, or `/*` as a suffix), or it is ignored.
+The `*.` prefix matches `hr.example.com` and all of its subdomains:
+
+```json
+{
+  "policies": {
+    "Watermark": {
+      "Match": ["https://*.hr.example.com/*", "https://finance.example.com/*"]
+    }
+  }
+}
+```
+
+### Adjusting the watermark colors
+
+A fainter color, smaller text and larger tiles keep the page readable.
+The watermark shows the default text of the user's email address and the time:
+
+```json
+{
+  "policies": {
+    "Watermark": {
+      "Match": ["https://*.intranet.example.com/*"],
+      "Color": "rgba(0, 0, 0, 0.08)",
+      "FontSize": 20,
+      "Size": 400
+    }
+  }
+}
+```
+
 ## Compatibility
 
 <PolicyCompat policy="Watermark" />