diff --git a/api/read/read.go b/api/read/read.go
index dd101dcf..30f55886 100644
--- a/api/read/read.go
+++ b/api/read/read.go
@@ -34,7 +34,7 @@ func ProtoJSON(r io.Reader, m proto.Message) error {
 }
 
 // ProtoJSONWithCheck reads JSON from the request body and stores it in the value
-// pointed to by v.
+// pointed to by v. Returns false if an error was written; true if not.
 func ProtoJSONWithCheck(w http.ResponseWriter, r io.Reader, m proto.Message) bool {
 	data, err := io.ReadAll(r)
 	if err != nil {
diff --git a/authority/provisioner/options.go b/authority/provisioner/options.go
index 7725c8b0..0975a4c2 100644
--- a/authority/provisioner/options.go
+++ b/authority/provisioner/options.go
@@ -61,10 +61,10 @@ type X509Options struct {
 	TemplateData json.RawMessage `json:"templateData,omitempty"`
 
 	// AllowedNames contains the SANs the provisioner is authorized to sign
-	AllowedNames *policy.X509NameOptions
+	AllowedNames *policy.X509NameOptions `json:"-"`
 
 	// DeniedNames contains the SANs the provisioner is not authorized to sign
-	DeniedNames *policy.X509NameOptions
+	DeniedNames *policy.X509NameOptions `json:"-"`
 }
 
 // HasTemplate returns true if a template is defined in the provisioner options.
diff --git a/authority/provisioner/ssh_options.go b/authority/provisioner/ssh_options.go
index 92c5826b..93633a21 100644
--- a/authority/provisioner/ssh_options.go
+++ b/authority/provisioner/ssh_options.go
@@ -37,10 +37,10 @@ type SSHOptions struct {
 	TemplateData json.RawMessage `json:"templateData,omitempty"`
 
 	// User contains SSH user certificate options.
-	User *policy.SSHUserCertificateOptions
+	User *policy.SSHUserCertificateOptions `json:"-"`
 
 	// Host contains SSH host certificate options.
-	Host *policy.SSHHostCertificateOptions
+	Host *policy.SSHHostCertificateOptions `json:"-"`
 }
 
 // GetAllowedUserNameOptions returns the SSHNameOptions that are