diff --git a/content/en/account_management/personal-access-tokens.md b/content/en/account_management/personal-access-tokens.md
index a2cd38021b0..ba4d38150f2 100644
--- a/content/en/account_management/personal-access-tokens.md
+++ b/content/en/account_management/personal-access-tokens.md
@@ -66,6 +66,16 @@ curl -X GET "https://api.datadoghq.com/api/v2/users" \
 
 **Note:** When a valid PAT is provided in the `dd-application-key` header, Datadog authenticates with the PAT only. The `dd-api-key` header is optional and its value is not evaluated.
 
+## Restrictions
+
+To limit how a PAT can escalate its own access, Datadog restricts what an API call authenticated with a PAT can do. These restrictions apply regardless of the API client making the call:
+
+- **Application keys**: A PAT cannot create or update application keys. Revoking application keys is still allowed.
+- **Scopes on new tokens**: A PAT can create or update a PAT or a SAT only if the new token's scopes are a subset of its own scopes.
+- **Time-to-live (TTL) on new tokens**: A PAT cannot create a PAT or a SAT with a TTL that outlives itself.
+
+These restrictions apply only to API calls authenticated with a PAT or SAT. A call that violates one of these restrictions returns a `403 Forbidden` response.
+
 ## Manage Personal Access Tokens
 
 ### View your tokens
diff --git a/content/en/account_management/service-access-tokens.md b/content/en/account_management/service-access-tokens.md
index 39d82be8d32..2d634b8bd42 100644
--- a/content/en/account_management/service-access-tokens.md
+++ b/content/en/account_management/service-access-tokens.md
@@ -91,6 +91,16 @@ curl -X GET "https://api.datadoghq.com/api/v2/users" \
 **Note:** When a valid SAT is provided in the `dd-application-key` header, Datadog authenticates
 with the SAT only. The `dd-api-key` header is optional and its value is not evaluated.
 
+## Restrictions
+
+To limit how a SAT can escalate its own access, Datadog restricts what an API call authenticated with a SAT can do, regardless of the API client making the call:
+
+- **Application keys**: A SAT cannot create or update application keys. Revoking application keys is still allowed.
+- **Scopes on new tokens**: A SAT can create or update another SAT only if the new token's scopes are a subset of its own scopes.
+- **Time-to-live (TTL) on new tokens**: A SAT cannot create a SAT with a TTL that outlives itself.
+
+These restrictions apply only to API calls authenticated with a PAT or SAT. A call that violates one of these restrictions returns a `403 Forbidden` response.
+
 ## Manage Service Access Tokens
 
 ### View tokens