diff --git a/acl/types.proto b/acl/types.proto
index 8e38d58..6425e40 100644
--- a/acl/types.proto
+++ b/acl/types.proto
@@ -190,7 +190,9 @@ message BearerToken {
   // owner with additional information preventing token's abuse.
   message Body {
     // Table of Extended ACL rules to use instead of the ones attached to the
-    // container
+    // container. If it contains `container_id` field, bearer token is only
+    // valid for this specific container. Otherwise, any container of the same owner
+    // is allowed.
     EACLTable eacl_table = 1 [json_name="eaclTable"];
 
     // `OwnerID` to whom the token was issued. Must match the request