diff --git a/SKILL.md b/SKILL.md
index 4903be5..06e524d 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -135,6 +135,7 @@ Find the row that matches the user's intent. The reference file contains the com
 | Set up PrivateLink / PSC, manage connectivity rules | Cloud connectivity | [cloud-connectivity.md](references/ops/cloud-connectivity.md) |
 | Self-hosted cluster health, describe, namespace CRUD | Self-hosted admin | [self-hosted-admin.md](references/ops/self-hosted-admin.md) |
 | Self-hosted search attributes, Nexus endpoints | Self-hosted admin | [self-hosted-admin.md](references/ops/self-hosted-admin.md) |
+| Check or manage a Cloud Nexus Endpoint's caller-Namespace allowlist; the 1,000-caller default | Cloud namespace admin | [cloud-namespace-admin.md#tcld-nexus-endpoint-allowed-namespace](references/ops/cloud-namespace-admin.md#tcld-nexus-endpoint-allowed-namespace) |
 | Find stuck/hung/unhealthy workflows via list queries | Workflow health | [workflow-health.md](references/ops/workflow-health.md) |
 | Task queue poller status, workflow counts | Workflow health | [workflow-health.md](references/ops/workflow-health.md) |
 | Cancel, terminate, or reset workflows | Workflow recovery | [workflow-stuck.md#recovery-commands](references/triage/workflow-stuck.md#recovery-commands) |
@@ -256,7 +257,7 @@ If the layer above the fix is still failing, return to step 4 and continue walki
 
 ### Operations
 
-- [cloud-namespace-admin.md](references/ops/cloud-namespace-admin.md) — Cloud namespace lifecycle via `tcld`: create, get, list, delete, failover, add-region, retention, tags, codec-server, HA config, connectivity rules, search attributes, accepted-client-ca, certificate filters, export.
+- [cloud-namespace-admin.md](references/ops/cloud-namespace-admin.md) — Cloud namespace lifecycle via `tcld`: create, get, list, delete, failover, add-region, retention, tags, codec-server, HA config, connectivity rules, search attributes, accepted-client-ca, certificate filters, export, and the `tcld nexus endpoint allowed-namespace` caller allowlist (1,000-caller Access Policy ceiling).
 - [cloud-capacity.md](references/ops/cloud-capacity.md) — Capacity modes (On-Demand / Provisioned), APS/RPS/OPS definitions, TRUs, `tcld namespace capacity update`, default limits, throttling, APS management best practices.
 - [cloud-iam.md](references/ops/cloud-iam.md) — API key lifecycle (`tcld apikey`), users (`tcld user`), user groups (`tcld user-group`), service accounts, account operations (`tcld account`), roles, namespace permissions.
 - [cloud-certs.md](references/ops/cloud-certs.md) — mTLS cert management: generating certs with `tcld generate-certificates`, uploading CAs, certificate filters, cert rotation, switching mTLS ↔ API keys.
diff --git a/references/ops/cloud-namespace-admin.md b/references/ops/cloud-namespace-admin.md
index a0e10e1..ca546f2 100644
--- a/references/ops/cloud-namespace-admin.md
+++ b/references/ops/cloud-namespace-admin.md
@@ -29,6 +29,8 @@ If `--namespace` is omitted, the environment variable `$TEMPORAL_CLOUD_NAMESPACE
 - Max tags per namespace: 10
 - Tag key/value length: 1-63 characters
 - Soft limit of 1000 unique tag keys per account
+- Max caller Namespaces per Nexus Endpoint Access Policy: 1,000 (support ticket to raise)
+- Max Nexus Endpoints per account: 100 (support ticket to raise)
 
 ---
 
@@ -559,6 +561,47 @@ state which one you mean when you propose it.
 
 ---
 
+## tcld nexus endpoint allowed-namespace
+
+Manages a Nexus Endpoint's Access Policy — the allowlist of caller Namespaces
+permitted to use the Endpoint at runtime. Cloud-only: self-hosted authorization
+goes through a custom Authorizer plugin instead. For Endpoint CRUD itself, see
+[self-hosted-admin.md § Nexus Endpoint Commands](self-hosted-admin.md#nexus-endpoint-commands),
+which maps each `temporal operator nexus` verb to its `tcld nexus` equivalent.
+
+| Subcommand | Purpose |
+|---|---|
+| `list` | Show the current allowlist |
+| `add` | Add caller Namespaces; entries already present are ignored |
+| `remove` | Remove caller Namespaces; entries not present are ignored |
+| `set` | Replace the entire allowlist |
+
+All subcommands take `--name` / `-n` (the Endpoint) and, except `list`,
+`--namespace` / `-ns`, which is repeatable:
+
+```bash
+tcld nexus endpoint allowed-namespace add \
+    --name <endpoint-name> \
+    --namespace <caller-ns-1> \
+    --namespace <caller-ns-2>
+```
+
+**No callers are allowed by default**, not even from the Endpoint's own target
+Namespace. The allowlist is empty at create time unless seeded with
+`--allow-namespace` (singular, a repeatable flag on `tcld nexus endpoint create`,
+not a subcommand).
+
+`set` replaces the full list, so any entry you don't pass is dropped — revoking
+those callers at their next Nexus Operation. Never run it on your own initiative.
+Run `list` first, name the exact entries it would drop, and ask the user directly;
+run it only once they have approved, and only against that Endpoint. Prefer `add`
+when the goal is to grant. Terraform manages the
+same field as `allowed_caller_namespaces`, so a `set` against a
+Terraform-provisioned Endpoint will be reverted on the next apply — see
+[cloud-terraform.md](cloud-terraform.md).
+
+---
+
 ## Endpoint and authentication summary
 
 | Auth method | Endpoint type | Format |