diff --git a/README.md b/README.md
index 4564d52..384ea86 100644
--- a/README.md
+++ b/README.md
@@ -76,12 +76,7 @@ values, and provisions the new namespace.
 * **Network Security:** A `NetworkPolicy` is deployed within each tenant namespace
 to restrict ingress/egress traffic. The Jupyter notebook can only communicate
 with necessary services, preventing cross-namespace communication.
-* **Automated & Isolated S3 Setup:** To prevent exposing admin credentials outside the storage
-infrastructure, a Kubernetes Job runs directly within the minio namespace during tenant provisioning.
-This job connects to the MinIO admin API locally, creates a reference bucket (Read-Only), a work bucket (Read/Write),
-and generates dedicated, scoped S3 credentials. It then creates the resulting secret containing only
-tenant-scoped credentials directly in the target tenant namespace **dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes
-Secret locally in the tenant's namespace.
+* **Automated & Isolated S3 Setup:** To avoid exposing admin credentials outside the storage infrastructure, a Kubernetes Job runs inside the minio namespace during tenant provisioning. It connects to the MinIO admin API locally, creates a read-only reference bucket and a read/write work bucket, and generates dedicated, tenant-scoped S3 credentials. The Job then writes those credentials directly into the target tenant namespace as a Secret, so only the scoped credentials (never the MinIO admin credentials) ever leave the minio namespace.
 * **Security Context:** The Docker images use the `tini` init system and execute
 application containers as a non-root user.
 * **Shared MinIO Instance:** A single MinIO deployment backs all tenants rather than one instance per tenant. This was an intentional choice: it keeps operational overhead low and leaves the door open for shared reference datasets across tenants. Isolation is enforced at the credential and bucket-policy level regardless of the sared backend, as demonstrated in section 4.2.