diff --git a/.github/agents/Doc_Writer.agent.md b/.github/agents/Doc_Writer.agent.md
index 0b819686..229f71fb 100644
--- a/.github/agents/Doc_Writer.agent.md
+++ b/.github/agents/Doc_Writer.agent.md
@@ -10,7 +10,7 @@ You value clarity, brevity, and accuracy. You translate "Engineer Speak" into "U
- **Project**: Charon
- **Docs Location**: `docs/` folder and `docs/features.md`.
-- **Style**: Professional, concise, using the existing markdown structure.
+- **Style**: Professional, concise, but also with the novice home user in mind. Use and "explain it like i'm five" language style. Use the existing markdown structure.
diff --git a/docs/api.md b/docs/api.md
index a0bec9db..9aff26d5 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -51,6 +51,23 @@ Authorization: Bearer
## Endpoints
+### Metrics (Prometheus)
+
+Expose internal counters for scraping.
+
+```http
+GET /metrics
+```
+
+No authentication required. Primary WAF metrics:
+```text
+charon_waf_requests_total
+charon_waf_blocked_total
+charon_waf_monitored_total
+```
+
+---
+
### Health Check
Check API health status.
@@ -68,6 +85,108 @@ GET /health
---
+### Security Suite (Cerberus)
+
+#### Status
+```http
+GET /security/status
+```
+Returns enabled flag plus modes for each module.
+
+#### Get Global Security Config
+```http
+GET /security/config
+```
+Response 200 (no config yet): `{ "config": null }`
+
+#### Upsert Global Security Config
+```http
+POST /security/config
+Content-Type: application/json
+```
+Request Body (example):
+```json
+{
+ "name": "default",
+ "enabled": true,
+ "admin_whitelist": "198.51.100.10,203.0.113.0/24",
+ "crowdsec_mode": "local",
+ "waf_mode": "monitor",
+ "waf_rules_source": "owasp-crs-local"
+}
+```
+Response 200: `{ "config": { ... } }`
+
+#### Enable Cerberus
+```http
+POST /security/enable
+```
+Payload (optional break-glass token):
+```json
+{ "break_glass_token": "abcd1234" }
+```
+
+#### Disable Cerberus
+```http
+POST /security/disable
+```
+Payload (required if not localhost):
+```json
+{ "break_glass_token": "abcd1234" }
+```
+
+#### Generate Break-Glass Token
+```http
+POST /security/breakglass/generate
+```
+Response 200: `{ "token": "plaintext-token-once" }`
+
+#### List Security Decisions
+```http
+GET /security/decisions?limit=50
+```
+Response 200: `{ "decisions": [ ... ] }`
+
+#### Create Manual Decision
+```http
+POST /security/decisions
+Content-Type: application/json
+```
+Payload:
+```json
+{ "ip": "203.0.113.5", "action": "block", "details": "manual temporary block" }
+```
+
+#### List Rulesets
+```http
+GET /security/rulesets
+```
+Response 200: `{ "rulesets": [ ... ] }`
+
+#### Upsert Ruleset
+```http
+POST /security/rulesets
+Content-Type: application/json
+```
+Payload:
+```json
+{
+ "name": "owasp-crs-quick",
+ "source_url": "https://example.com/owasp-crs.txt",
+ "mode": "owasp",
+ "content": "# raw rules"
+}
+```
+Response 200: `{ "ruleset": { ... } }`
+
+#### Delete Ruleset
+```http
+DELETE /security/rulesets/:id
+```
+Response 200: `{ "deleted": true }`
+
+---
+
### Proxy Hosts
#### List All Proxy Hosts
diff --git a/docs/cerberus.md b/docs/cerberus.md
new file mode 100644
index 00000000..0858bdf3
--- /dev/null
+++ b/docs/cerberus.md
@@ -0,0 +1,137 @@
+# Cerberus Security Suite
+
+Cerberus is Charon's optional, modular security layer bundling a lightweight WAF pipeline, CrowdSec integration, Access Control Lists (ACLs), and future rate limiting. It focuses on *ease of enablement*, *observability first*, and *gradual enforcement* so home and small business users avoid accidental lockouts.
+
+---
+## Architecture Overview
+
+Cerberus sits as a Gin middleware applied to all `/api/v1` routes (and indirectly protects reverse proxy management workflows). Components:
+
+| Component | Purpose | Current Status |
+| :--- | :--- | :--- |
+| WAF | Inspect requests, detect payload signatures, optionally block | Prototype (placeholder `