diff --git a/CHANGELOG.md b/CHANGELOG.md
index f2082ae..d9504ef 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,23 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-13 — The access of an object, on the object `web 0.172.0`
+
+**Who reaches a machine, a folder or a credential — and changing it — where it is.** A machine's
+panel has an **Access** section; a machine folder, a credential folder and a credential have an
+**Access** action. Each shows who reaches it and through which line, and **Add access** poses a
+profile on it with the object already chosen. On machines and machine folders, **Assistant** sets
+what the assistant may do there.
+
+- **The organization's Access page keeps the whole picture**: by person, by object, and its rules —
+  the tab once called _Rows_ is _Rules_, and its two lists are _People_ and _Assistant_.
+- **The scope in the authorization dialog names the scope**, with what it does written under it,
+  instead of showing that description in its place.
+- **Who reaches an object counts members over members**: a platform administrator who is not a
+  member is still listed, but no longer makes it read _5 of 4_.
+
+Update the web image. No API or agent update is required.
+
 ## 2026-10-12 — An organization's policies on one page `api 0.142.0` `web 0.171.0`
 
 **Policies, then sessions.** In an organization's administration, agent updates, terminal sessions