diff --git a/README.md b/README.md
index 8f0aa39..1b3a1a5 100644
--- a/README.md
+++ b/README.md
@@ -152,7 +152,55 @@ bash models/pull-models.sh --tier=pro
 bash models/pull-models.sh --tier=max
 ```
 
-## 7. What Gets Installed
+## 7. Product Features
+
+Nexus One AI includes these application features through the portal and backend:
+
+| Feature | What It Does |
+|---|---|
+| Secure admin portal | Browser UI for setup, chat, tools, users, models, reports, and system status. |
+| Authentication and sessions | JWT login, role-aware admin access, brute-force lockout, active session tracking. |
+| User and team management | Admin-managed users, teams, roles, and account status. |
+| Private chat | On-prem chat over local or routed models. |
+| RAG knowledge base | Upload documents, index them into ChromaDB, and query private knowledge. |
+| Prompt library | Government/enterprise prompt templates grouped by use case. |
+| Model management | View local models, pull Ollama models, upload GGUF models, and track model status. |
+| Model router | Route requests by rule to local, GPU, or external model endpoints on supported tiers. |
+| Document intelligence | Parse, summarize, and extract structured information from documents. |
+| Meeting assistant | Transcript/audio processing, summaries, decisions, action items, and follow-ups. |
+| Agent builder | Create and run configured agents, including scheduled agent jobs. |
+| Workflow automation | Run portal workflows with HTTP, email, RAG, save-to-knowledge-base, and filter steps. |
+| Connectors | Store and sync supported data connectors. |
+| Guardrails | Keyword, regex, and PII checks for safer prompts and responses. |
+| Analytics and audit | Query logs, usage summaries, audit reports, and admin visibility. |
+| Evaluation suite | Manage datasets, eval jobs, and model/prompt quality checks. |
+| Fine-tuning jobs | QLoRA and advanced training paths for higher tiers. |
+| API key manager | Create, list, and revoke API keys for integrations. |
+| Backups and restore | Local backup, list, restore, and pre-restore safety snapshot APIs. |
+| System readiness | Feasibility, license, and readiness reports for handover and support. |
+
+## 8. Features By Tier
+
+The backend exposes this same matrix from `GET /api/license`.
+
+| Feature | Starter | Entry / Basic | Pro | Max |
+|---|---|---|---|---|
+| Max users | 10 | 25 | 100 | Custom |
+| Portal | Yes | Yes | Yes | Yes |
+| Private chat | Yes | Yes | Yes | Yes |
+| RAG knowledge base | Yes | Yes | Advanced | Advanced |
+| Meeting assistant | No | Yes | Yes | Yes |
+| Workflows | Basic | Basic | Advanced | Advanced |
+| Connectors | No | Limited | Yes | Yes |
+| Model router | No | No | Yes | Yes |
+| Audit reports | Yes | Yes | Yes | Yes |
+| Backup and restore | Yes | Yes | Yes | Yes |
+| Guardrails | Basic | Basic | Advanced | Advanced |
+| GPU inference | No | Optional | Yes | Yes |
+| Fine-tuning | No | No | QLoRA | Advanced |
+| DeepSpeed / distributed training | No | No | No | Custom |
+
+## 9. What Gets Installed
 
 All tiers install the Nexus One AI portal, backend API, nginx, health/readiness
 reporting, license/tier handling, and selected AI tools.
@@ -170,7 +218,7 @@ reporting, license/tier handling, and selected AI tools.
 | MinIO | 9001 | S3-compatible object/model storage. |
 | Grafana | 3000 | Monitoring dashboard. |
 
-## 8. Admin And Readiness APIs
+## 10. Admin And Readiness APIs
 
 | API | Purpose |
 |---|---|
@@ -190,7 +238,7 @@ sudo bash scripts/cezen-backup.sh list
 sudo bash scripts/cezen-backup.sh restore /opt/cezen/backups/cezen-backup-YYYYmmdd-HHMMSS.zip
 ```
 
-## 9. Post-Install Checks
+## 11. Post-Install Checks
 
 Run these after install:
 
@@ -213,7 +261,7 @@ Check Ollama models:
 curl -s http://localhost:11434/api/tags
 ```
 
-## 10. Test Without A GPU
+## 12. Test Without A GPU
 
 On a MacBook:
 
@@ -233,7 +281,7 @@ sudo bash install.sh --software-only --profile=auto --skip-model-pull
 
 No GPU will be detected. That is expected.
 
-## 11. Change Default Passwords Before Customer Handover
+## 13. Change Default Passwords Before Customer Handover
 
 Before shipping to a customer, rotate these:
 
@@ -244,7 +292,7 @@ Before shipping to a customer, rotate these:
 - Any temporary portal/backend admin credentials.
 - Any staging license key if the final license is issued later.
 
-## 12. Useful Files
+## 14. Useful Files
 
 ```text
 cgit/