diff --git a/google_secops_parser/parsedmarc.conf b/google_secops_parser/parsedmarc.conf
index 0c3b267d..e9f8c70c 100644
--- a/google_secops_parser/parsedmarc.conf
+++ b/google_secops_parser/parsedmarc.conf
@@ -203,16 +203,21 @@ filter {
   }
 
   # ---------------------------------------------------------------------------
-  # 1b. Convert parsedmarc's JSON booleans to strings so they can be compared
-  #     in conditionals. The json{} filter PRESERVES the original JSON type,
-  #     and CBN conditionals compare against that type, so without this
-  #     [dmarc_aligned] is a boolean and `== "false"` never matches. This is
-  #     ONLY for the `if` guards: in additional.fields these values are
-  #     converted back and stored as typed bool_value (see the alignment
-  #     blocks below), matching the [gsecops] API output. Numeric fields are
-  #     deliberately NOT converted here -- they are stored as number_value in
-  #     additional.fields so SecOps can range-query and sort them; see the
-  #     count / *_session_count / source_asn blocks below.
+  # 1b. Convert parsedmarc's JSON booleans to strings, purely so they can be
+  #     tested in conditionals. CBN's documented conditional syntax only
+  #     compares a token against a quoted string literal (there is no
+  #     `== true` boolean literal, and no truthiness test on event fields),
+  #     while json{} PRESERVES the original JSON type -- so without this
+  #     conversion `[dmarc_aligned] == "false"` can never match and the
+  #     AUTH_VIOLATION decision below never fires. The conversion is in place
+  #     because CBN mutate has no `copy` function to make a disposable string
+  #     copy. Storage is unaffected: additional.fields converts these values
+  #     back and stores typed bool_value (see the alignment blocks below),
+  #     matching the [gsecops] API output. Numeric fields are deliberately
+  #     NOT converted here -- nothing branches on them; they are staged and
+  #     stored as number_value (see the count / *_session_count / source_asn
+  #     blocks below).
+  #     https://docs.cloud.google.com/chronicle/docs/reference/parser-syntax
   # ---------------------------------------------------------------------------
   mutate {
     convert => {