diff --git a/specification/draft/apps.mdx b/specification/draft/apps.mdx
index aed5611..59eaa02 100644
--- a/specification/draft/apps.mdx
+++ b/specification/draft/apps.mdx
@@ -1648,7 +1648,7 @@ Hosts MUST enforce Content Security Policies based on resource metadata.
 **CSP Construction from Metadata:**
 
 ```typescript
-const csp = resource._meta?.ui?.csp;
+const csp = resource._meta?.ui?.csp; // `resource` is extracted from the `contents` of the `resources/read` result
 const permissions = resource._meta?.ui?.permissions;
 
 const cspValue = `