diff --git a/docs/security.md b/docs/security.md
index deceef5..d902caf 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -87,7 +87,7 @@ createREST({
 
 ## Row security
 
-With Postgres, row security is the strongest perimeter: the database itself hides the rows a session may not see. Connect as a role without `BYPASSRLS`, and set what your policies read in the `transaction` hook:
+Row security needs PostgreSQL, or SQL Server with security policies (see [Dialects](./dialects.md#sql-server)). With Postgres, it is the strongest perimeter: the database itself hides the rows a session may not see. Connect as a role without `BYPASSRLS`, and set what your policies read in the `transaction` hook:
 
 ```ts
 async transaction(tx, context) {
diff --git a/docs/writes.md b/docs/writes.md
index 4285b8c..87f6169 100644
--- a/docs/writes.md
+++ b/docs/writes.md
@@ -194,6 +194,8 @@ Answer: 409
 
 ## Procedures
 
+PostgreSQL, MySQL and SQL Server run procedures; SQLite has no functions to call. A MySQL function returns a single value, and a SQL Server function cannot change data.
+
 A procedure calls a database function at a path you choose. A `{name}` in the path passes that segment as the argument of the same name; the body's keys pass the others. Arguments are checked by name and type, and one with a default may be left out.
 
 A procedure is a POST unless declared `method: 'GET'`. A GET procedure takes its arguments from the query string (`/search?q=milk&limit=10`), each once, and runs in a read-only transaction: use it for a function without side effects.