diff --git a/documents/03-authentication-and-users.md b/documents/03-authentication-and-users.md
new file mode 100644
index 0000000..87c744c
--- /dev/null
+++ b/documents/03-authentication-and-users.md
@@ -0,0 +1,34 @@
+# Authentication and User Management
+
+## Google OAuth Flow
+
+Google
+-> Portal
+-> Users table
+
+Fields:
+- email
+- display_name
+- avatar_url
+- provider_subject
+- auth_provider
+- last_login_at
+
+## User Creation
+
+First user:
+- admin
+
+Additional users:
+- viewer
+
+## AUTH_MODE
+
+google
+- Google only
+
+mixed
+- Google + local fallback
+
+local
+- Local login only
diff --git a/documents/04-roadmap.md b/documents/04-roadmap.md
new file mode 100644
index 0000000..5b0c442
--- /dev/null
+++ b/documents/04-roadmap.md
@@ -0,0 +1,25 @@
+# Roadmap
+
+## High Priority
+
+### Gitea Provisioning Validation
+- viewer -> developer
+- developer -> viewer
+- admin -> developer
+- enable / disable user
+
+### TLS Restore Fix
+Preserve Caddy ACME state.
+
+## Medium Priority
+- Monitoring
+- Alerting
+- Gitea team mapping
+
+## Long Term
+Google
+-> Portal
+-> Gitea
+-> Additional services
+
+Single sign-on ecosystem.