diff --git a/src/pages/client/profile-ownership.mdx b/src/pages/client/profile-ownership.mdx
index 8e81d2d8..9a42fc12 100644
--- a/src/pages/client/profile-ownership.mdx
+++ b/src/pages/client/profile-ownership.mdx
@@ -186,6 +186,22 @@ netbird up --setup-key <SETUP_KEY>
 
 Run `netbird up` as the user that you set with `--owner`. If you omit `--owner`, the owner is the user who ran `sudo`.
 
+## How a connection works on a shared machine
+
+Profile ownership controls who can operate the daemon. It does not control who can send traffic through the connection.
+
+The NetBird connection belongs to the whole machine. When a user connects, the daemon creates a network interface, routes, and DNS settings for all users of the machine. The daemon also connects at startup with the last active profile, before any user logs in.
+
+On a shared machine, this has these results:
+
+- **All local users use the connection.** If Alice connects, Bob can log in and reach the same peers and resources as Alice. NetBird access policies apply to the peer, not to the local user.
+- **Only the session holder controls the daemon.** Bob cannot disconnect, switch profiles, or read detailed status. Bob gets a message that says another user has the machine connected.
+- **The connection stays after the owner logs out.** It stays until the owner or an administrator runs `netbird down`.
+
+<Warning>
+  Do not use profile ownership to separate the network access of local users. Give a shared machine only the access that all its users need. To stop the connection at startup, run `netbird up --disable-auto-connect`, or set the `disableAutoConnect` [MDM key](/client/mdm-integration).
+</Warning>
+
 ## Share a profile between users
 
 On a shared computer, for example in a lab or at a reception desk, many users can use the same profile. A profile has only one owner, so profile ownership stops the other users.