diff --git a/docs/concepts/policy/pod-security-policy.md b/docs/concepts/policy/pod-security-policy.md
index 5c80934751..d73baed1cc 100644
--- a/docs/concepts/policy/pod-security-policy.md
+++ b/docs/concepts/policy/pod-security-policy.md
@@ -153,7 +153,10 @@ controller selects policies in the following order:
 
 1. If any policies successfully validate the pod without altering it, they are
    used.
-2. Otherwise, the first valid policy in alphabetical order is used.
+2. If it is a pod creation request, then the first valid policy in alphabetical
+   order is used.
+3. Otherwise, if it is a pod update request, an error is returned, because pod mutations
+   are disallowed during update operations.
 
 ## Example