diff --git a/README.md b/README.md
index ff594cc..c3f3d1c 100644
--- a/README.md
+++ b/README.md
@@ -566,6 +566,8 @@ To build this into a Zero-Trust environment (useful in IoT or other critical env
 
 ![Diagram: Agentic Cross-Domain ZTNA](figures/ztna.png)
 
+In this diagram, secure connections are only made outbound from operational systems into a secure DMZ.  No ports need to be opened on the operational (private, public or IoT systems).  However, logically it will appear at the protocol layer as one connection, so the application need not have additional logic to deal with this.
+
 ---
 
 ## 8  Future Enhancements
diff --git a/figures/ztna.png b/figures/ztna.png
index 5b50c63..432df0e 100644
Binary files a/figures/ztna.png and b/figures/ztna.png differ