diff --git a/docs/sandbox-permissions.rst b/docs/sandbox-permissions.rst
index c4e76bc1..1c567e00 100644
--- a/docs/sandbox-permissions.rst
+++ b/docs/sandbox-permissions.rst
@@ -424,6 +424,19 @@ Typical non-GNOME and non-GTK applications should use::
 No application should be using ``--talk-name=org.gtk.vfs`` in its manifest, as
 there are no D-Bus services named ``org.gtk.vfs``.
 
+These permission grants the app, the ability to communicate with the
+gvfs daemon and backends running on host. Depending on the backends
+installed or running on host, it grants the ability to list mounted
+devices (USB, optical etc.), detach/format/eject them, mount them
+locally, read and write data. This is usually used with network storages
+like WebDAV, Google Drive, SMB etc. but backends exist for MTP/PTP,
+`USB <https://gitlab.gnome.org/GNOME/gvfs/-/tree/master/monitor/udisks2?ref_type=heads>_`,
+special locations like ``trash://`` and the
+`local filesystem <https://gitlab.gnome.org/GNOME/gvfs/-/blob/master/daemon/gvfsbackendlocaltest.c?ref_type=heads>`_
+too. So the app can access, read and write data from all of these
+locations provided the daemon and backends are installed and running
+on host.
+
 External drive access
 `````````````````````