improvement(docs): restore FAQs and genuine-gotcha callouts

Author: waleedlatif1

apps/docs/content/docs/en/enterprise/access-control.mdx

@@ -3,6 +3,7 @@ title: Access Control
 description: Restrict which models, blocks, and platform features each group of users can access
 ---
 
+import { Callout } from 'fumadocs-ui/components/callout'
 import { FAQ } from '@/components/ui/faq'
 import { Image } from '@/components/ui/image'
 
@@ -53,7 +54,11 @@ Controls which workflow blocks members can place and execute.
 <Image src="/static/enterprise/access-control-blocks.png" alt="Blocks tab showing Core Blocks (Agent, API, Condition, Function, Knowledge, etc.) and Tools (integrations like 1Password, A2A, Ahrefs, Airtable, and more) with checkboxes to allow or restrict each" width={900} height={500} /> Blocks are split into two sections: **Core Blocks** (Agent, API, Condition, Function, etc.) and **Tools** (all integration blocks).
 
 - **All checked (default):** All blocks are allowed.
-- **Subset checked:** Only the selected blocks are allowed. Workflows that already contain a disallowed block will fail when run — they are not automatically modified. The `start_trigger` block (the entry point of every workflow) is always allowed and cannot be restricted.
+- **Subset checked:** Only the selected blocks are allowed. Workflows that already contain a disallowed block will fail when run — they are not automatically modified.
+
+<Callout type="info">
+  The `start_trigger` block (the entry point of every workflow) is always allowed and cannot be restricted.
+</Callout>
 
 #### Platform
 

apps/docs/content/docs/en/enterprise/index.mdx

@@ -3,6 +3,8 @@ title: Enterprise
 description: Enterprise features for business organizations
 ---
 
+import { FAQ } from '@/components/ui/faq'
+
 Sim Enterprise provides advanced features for organizations with enhanced security, compliance, and management requirements.
 
 ---
@@ -55,6 +57,14 @@ Configure how long execution logs, soft-deleted resources, and Mothership data a
 
 ---
 
+<FAQ items={[
+  { question: "Who can manage Enterprise features?", answer: "Workspace admins on an Enterprise-entitled workspace. Access Control, SSO, whitelabeling, audit logs, and data retention are all configured per workspace under Settings → Enterprise." },
+  { question: "Which SSO providers are supported?", answer: "Sim supports SAML 2.0 and OIDC, which works with virtually any enterprise identity provider including Okta, Azure AD (Entra ID), Google Workspace, ADFS, and OneLogin." },
+  { question: "How do access control permission groups work?", answer: "Permission groups are created per workspace and let you restrict which AI providers, workflow blocks, and platform features are available to specific members of that workspace. Each user can belong to at most one group per workspace. Users not assigned to any group have full access. Restrictions are enforced at both the UI level and at execution time based on the workflow's workspace." },
+]} />
+
+---
+
 ## Self-hosted setup
 
 Self-hosted deployments enable enterprise features via environment variables instead of billing.

apps/docs/content/docs/en/enterprise/sso.mdx

@@ -219,7 +219,11 @@ Once SSO is configured, users with your domain (`company.com`) can sign in throu
 4. After authenticating, they are returned to Sim and added to your organization automatically
 5. They land in the workspace
 
-Users who sign in via SSO for the first time are automatically provisioned and added to your organization — no manual invite required. Password-based login remains available; forcing all organization members to use SSO exclusively is not yet supported.
+Users who sign in via SSO for the first time are automatically provisioned and added to your organization — no manual invite required.
+
+<Callout type="info">
+  Password-based login remains available. Forcing all organization members to use SSO exclusively is not yet supported.
+</Callout>
 
 ---
 

apps/docs/content/docs/en/enterprise/whitelabeling.mdx

@@ -3,6 +3,7 @@ title: Whitelabeling
 description: Replace Sim branding with your own logo, colors, and links
 ---
 
+import { FAQ } from '@/components/ui/faq'
 import { Image } from '@/components/ui/image'
 
 Whitelabeling lets you replace Sim's default branding — logo, colors, and support links — with your own. Members of your organization see your brand instead of Sim's throughout the workspace.
@@ -11,8 +12,6 @@ Whitelabeling lets you replace Sim's default branding — logo, colors, and supp
 
 ## Setup
 
-Organization owners and admins on an Enterprise-entitled workspace can configure whitelabeling.
-
 ### 1. Open Whitelabeling settings
 
 Go to **Settings → Enterprise → Whitelabeling** in your workspace.
@@ -69,6 +68,27 @@ Whitelabeling applies only to members of your organization. Public-facing pages
 
 ---
 
+<FAQ items={[
+  {
+    question: "Who can configure whitelabeling?",
+    answer: "Organization owners and admins can configure whitelabeling. On Sim Cloud, you must be on the Enterprise plan."
+  },
+  {
+    question: "What image formats are supported?",
+    answer: "PNG, JPEG, SVG, and WebP. Maximum file size is 5 MB for both the logo and wordmark."
+  },
+  {
+    question: "What is the difference between the logo and the wordmark?",
+    answer: "The logo is a square image shown in the collapsed sidebar. The wordmark is a wide image shown in the expanded sidebar alongside member names and navigation items."
+  },
+  {
+    question: "Do members outside my organization see the custom branding?",
+    answer: "No. Custom branding is scoped to your organization. Members see your branding when signed in to your organization's workspace."
+  }
+]} />
+
+---
+
 ## Self-hosted setup
 
 Self-hosted deployments use environment variables instead of the billing/plan check.