--- a/mod_firewall/README.markdown	Wed Nov 02 20:42:27 2016 +0100
+++ b/mod_firewall/README.markdown	Fri Nov 04 12:46:11 2016 +0000
@@ -204,6 +204,27 @@
 stanza. It is not advisable to perform access control or similar rules
 on JIDs in these chains (see the chain documentation for more info).
 
+### Roster
+
+These functions access the roster of the recipient (only). Therefore they cannot (currently)
+be used in some chains, such as for outgoing messages (the recipient may be on another server).
+
+Performance note: this check can potentially cause storage access (especially if the recipient
+is currently offline), so you may want to limit its use in high-traffic situations, and place
+it below other checks (such as a rate limiter).
+
+#### IN_ROSTER
+
+Tests whether the sender is in the recipient's roster.
+
+    IN_ROSTER: yes
+
+#### IN_ROSTER_GROUP
+
+Tests whether the sender is in the recipient's roster, and in the named group.
+
+    IN_ROSTER_GROUP: Friends
+
 ### Time and date
 
 #### TIME