diff --git a/content/docs/build/agents.mdx b/content/docs/build/agents.mdx
index 8ba9f7d..767a88e 100644
--- a/content/docs/build/agents.mdx
+++ b/content/docs/build/agents.mdx
@@ -47,7 +47,7 @@ export const tier1Support = defineAgent({
 });
 ```
 
-Or in the UI: **Agents → New Agent**.
+Or in the UI: **Studio → Agents → New Agent**.
 
 Or — and this is the point — say to the AI Builder:
 
diff --git a/content/docs/build/data/index.mdx b/content/docs/build/data/index.mdx
index b19fef5..4d7a8db 100644
--- a/content/docs/build/data/index.mdx
+++ b/content/docs/build/data/index.mdx
@@ -18,7 +18,7 @@ is generating and can edit it directly when you want to.
 | Path | Looks like |
 |---|---|
 | **AI Builder** (primary) | *"Create a `support_ticket` object with subject, description, priority, status, assignee."* |
-| **Click-build** | **Objects → New Object** → forms |
+| **Click-build** | **Studio → Objects → New Object** → forms |
 | **TypeScript (`*.object.ts`)** | The TS shown below — typically inside a forked [template](/docs/build/templates) |
 
 All three produce the same schema. The schema is canonical; everything
diff --git a/content/docs/build/packages.mdx b/content/docs/build/packages.mdx
index 6228799..72cde73 100644
--- a/content/docs/build/packages.mdx
+++ b/content/docs/build/packages.mdx
@@ -51,7 +51,7 @@ pnpm dev
 
 ### From the UI
 
-**Packages → New Package** — name, id, version, namespace.
+**Studio → Packages → New Package** — name, id, version, namespace.
 
 ## Active package
 
diff --git a/content/docs/configure/index.mdx b/content/docs/configure/index.mdx
index 4f22320..cc87002 100644
--- a/content/docs/configure/index.mdx
+++ b/content/docs/configure/index.mdx
@@ -10,9 +10,24 @@ You manage people and their permissions day to day; the applications,
 objects, and permission sets themselves ship with the platform and the
 app packages you install.
 
-> **Permissions are designed in Studio, assigned in Setup.** Most
-> administration never leaves Setup — you enter Studio only to author
-> permission sets or to run the explain engine.
+## Setup and Studio
+
+**Permissions are designed in Studio, assigned in Setup.** That
+sentence is the canonical statement of a split that runs through the
+whole product, not a rule about permissions alone: Setup *operates* a
+running deployment, Studio *authors* the metadata that deployment runs.
+Both live inside the same UI at `/_console/`; neither is a surface of
+its own.
+
+| | Setup | Studio |
+|---|---|---|
+| Answers | Who is here, and what may they do? | What does this app consist of? |
+| Where | `/_console/apps/setup` | `/_console/studio` |
+| Gated by | `setup.access` | `studio.access` |
+| For | System administrators | Implementers and developers |
+
+Most administration never leaves Setup — you enter Studio only to
+author permission sets or to run the explain engine.
 
 ## The Setup app
 
diff --git a/content/docs/configure/permissions/index.mdx b/content/docs/configure/permissions/index.mdx
index 55d4ec5..5d80a88 100644
--- a/content/docs/configure/permissions/index.mdx
+++ b/content/docs/configure/permissions/index.mdx
@@ -161,9 +161,9 @@ applies uniformly across REST, ObjectQL, and the UI.
 - The **explain engine** (`explain(principal, object, operation)`)
   reports the verdict of every layer in order — required permissions,
   object CRUD, field security, OWD baseline, sharing, row-level
-  security — with per-layer attribution. It surfaces as the
-  "Why can this user access?" panel. Explaining another user requires
-  the `manage_users` capability.
+  security — with per-layer attribution. Studio's **Access** pillar
+  surfaces it as the "Why can this user access?" panel. Explaining
+  another user requires the `manage_users` capability.
 - `/_console/` shows the effective permissions of any user as they're
   evaluated.
 - Audit log (`sys_audit_log`) records permission-sensitive changes —
diff --git a/content/docs/resources/glossary.mdx b/content/docs/resources/glossary.mdx
index 815749f..7cd37e5 100644
--- a/content/docs/resources/glossary.mdx
+++ b/content/docs/resources/glossary.mdx
@@ -199,6 +199,19 @@ query time, compiled into row-level filters. A rule stored **without**
 criteria shares nothing — it is not a match-all. See
 [Record Access](/docs/configure/permissions/record-access#both-switches-fail-closed).
 
+### Studio
+
+The built-in metadata-authoring surface, at `/studio` inside the UI
+served at `/_console/`, gated by the `studio.access` permission.
+Where the metadata itself is *designed* — packages, objects, apps,
+flows and permission sets — one package at a time, across four pillars:
+Data, Automations, Interfaces, Access. Peer of **Setup**, not part of
+it: Setup operates a running deployment (its people, their grants, its
+configuration), Studio authors what that deployment runs — hence
+**permissions are designed in Studio, assigned in Setup**. Unlike
+Setup it is not an app under `/apps/`; the UI serves it as its own
+route subtree. See [Administration](/docs/configure#setup-and-studio).
+
 ### Surface
 
 One of the HTTP entry points a running ObjectOS exposes: `/` (REST API)