diff --git a/docs/flex-auth-caller-identity.md b/docs/flex-auth-caller-identity.md
index cab46de..13b9a2d 100644
--- a/docs/flex-auth-caller-identity.md
+++ b/docs/flex-auth-caller-identity.md
@@ -54,6 +54,13 @@ Do not re-run these against `warn`: step 2 would return a decision.
 recorded run used Python. The bash shape below is the contract, not the
 exact live invocation.
 
+The target cluster is railiance01 (node `92.205.62.239`). Run the commands
+on the node (`ssh railiance01`, then the commands below). If you run them
+from the workstation, first confirm that `kubectl get nodes -o wide` shows
+that IP. A kubeconfig pointing at the retired coulombcore cluster answers
+with the wrong cluster (see
+`the-custodian/docs/agent-environment-orientation.md` §1).
+
 ```bash
 POD=$(kubectl -n user-engine get pod -l app.kubernetes.io/name=user-engine \
   -o jsonpath='{.items[0].metadata.name}')