diff --git a/README.md b/README.md
index be250db..67605f1 100644
--- a/README.md
+++ b/README.md
@@ -96,15 +96,17 @@ graph TB
   - Server verifies client certificate against the Subordinate/Root CA.
 - **Client CN Identification & Revocation**: In the TLS handshake, the server extracts the `commonName` attribute (`client_id`), validates that the client is marked `active` in the `clients` table, updates the `last_seen` timestamp, and drops unregistered or revoked certificates immediately.
 
-### 2. Master License Authority (`logar.eibl.tech`) & Seat-Bearing Subordinate CA
+### 2. Master License Authority (`logar.eibl.tech`), Multi-Tenancy & Subordinate CA
 - **Master Root Authority**: Standalone PKI repository & submodule ([`LOGAR-LICENSING/`](file:///u:/max/Desktop/LOGAR/LOGAR-LICENSING/README.md), upstream at [`https://gitea.eibl.tech/me0nline/LOGAR-LICENSING.git`](https://gitea.eibl.tech/me0nline/LOGAR-LICENSING.git)) deployed at `logar.eibl.tech`.
-
+- **Multi-Tenant Fleet Isolation & User Management**:
+  - Supports multiple isolated **Tenants** (e.g. `DEFAULT`, `CORP_A`, `PRODUCTION_FLEET`) with live tenant filtering.
+  - Built-in user management with PBKDF2 password hashing, RBAC (Administrators & Operators), and self-service password updates.
 - **Custom Enterprise X.509 OIDs**:
   - `OID_LOGAR_SEATS (1.3.6.1.4.1.59999.1.1)`: Embeds the exact licensed seat quota directly inside the signed Subordinate CA certificate.
   - `OID_LOGAR_LICENSE_ID (1.3.6.1.4.1.59999.1.2)`: Uniquely tracks enterprise license entitlement.
   - `OID_LOGAR_ISSUER_URL (1.3.6.1.4.1.59999.1.3)`: Embedded endpoint coordinate (`https://logar.eibl.tech`).
 - **Bootstrap `.lic` Packages & Instant WebSocket Auto-Enrollment**:
-  - The License Authority (`logar.eibl.tech`) generates initial **Bootstrap `.lic` Packages** containing Master Root CA, dedicated communication credentials (`communication_cert` + `communication_key`), CSR templates, and WebSocket coordinates (`wss://logar.eibl.tech/ws/license`).
+  - The License Authority (`logar.eibl.tech`) generates initial **Bootstrap `.lic` Packages** containing Master Root CA, dedicated communication credentials (`communication_cert` + `communication_key`), CSR templates, assigned tenant, and WebSocket coordinates bound directly to the authority server host.
   - **1-Click Import & Live Signing**: Importing the `.lic` file on the client server (`python src/Server.py --import-lic <file.lic>` or via WebUI) connects directly via **WebSocket**, submits the server Sub-CA CSR, and immediately installs the officially signed Sub-CA license certificate.
 - **Self-Updating Client Servers & Live WebSocket Sync**:
   - Client servers update themselves against the master authority (`wss://logar.eibl.tech/ws/license`) over WebSocket (`python src/Server.py --sync-license` or via WebUI / automated watchdog).
@@ -113,7 +115,7 @@ graph TB
 - **Automated Container Pipeline & Ephemeral NPM Pass-Through**:
   - The license authority repository includes a dedicated CI/CD workflow ([`.gitea/workflows/build-container.yml`](file:///u:/max/Desktop/LOGAR/LOGAR-LICENSING/.gitea/workflows/build-container.yml)) publishing to `gitea.eibl.tech/me0nline/logar-licensing:latest` (authenticated via `giteatoken` secret).
   - Works seamlessly with ephemeral Nginx Proxy Manager (NPM) by enabling the standard **Websockets Support** toggle for `logar.eibl.tech`.
-  - Admin WebUI is protected by session login (`/login`, default: `admin` / `admin_license_2026!`).
+  - Admin WebUI is protected by authenticated login with user and tenant administration.
 
 ### 3. Integrated Fleet Licensing & WebUI Dashboard
 - **WebUI URL**: Accessible at `http://<server_host>:8443/webui` (or `/`).