diff --git a/admin/Migration_Guide_From_Teiid_8.x.adoc b/admin/Migration_Guide_From_Teiid_8.x.adoc
index 74b207c42c..3a62b4fb2a 100644
--- a/admin/Migration_Guide_From_Teiid_8.x.adoc
+++ b/admin/Migration_Guide_From_Teiid_8.x.adoc
@@ -54,6 +54,10 @@ In addition there is a new property trust-all-local that defaults to true and al
 
 The RoleBasedCredentialMapIdentityLoginModule class has been removed.  Consider alternative login modules with roles assignments to restrict access to the VDB.
 
+==== System Metadata
+
+With data roles enabled system tables (SYS, SYSADMIN, and pg_catalog) will only expose tables, columns, procedures, etc. for which the user is entitled to access.  A READ permission is expected for tables/columns, while an EXECUTE permission is expected for functions/procedures.  All non-hidden schemas will still be visible though.
+
 === Local Transport
 
 The embedded transport was renamed to local to avoid confusion with Teiid embedded.
@@ -66,6 +70,10 @@ The resolver’s default behavior was to widen comparisons to string, but 9.0 no
 
 == Kitting/Build Changes
 
+=== API Changes
+
+The AuthorizationValidator and PolicyDecider interfaces had minor changes.  AuthorizationValidator has an additional method to determine metadata filtering, and PolicyDecider had isTempAccessable corrected to isTempAccessible.
+
 === Embedded Kit
 
 The Embedded Kit has been removed.  You should follow the https://github.com/teiid/teiid-embedded-examples[Embedded Examples] to use maven to pull the dependencies you need for your project.