diff --git a/comment/README.md b/comment/README.md
index be2c5fc..38b57b3 100644
--- a/comment/README.md
+++ b/comment/README.md
@@ -28,9 +28,19 @@ The action supports the following inputs:
 
 - `target-type`: Optional. Which objects should be commented on, either `pull-request` or `commit`.
 
-- `tag`: Optional. Customize the comment tag. This is added to the comment as a markdown comment to detect the previously posted comments. This is useful if you have multiple workflows that post comments to the same pull request or commit.
-
-- `github-token`: Optional, default to `${{ github.token }}`. This is the default GitHub token available to actions and is used to post comments.
+- `tag`: Optional. Customize the comment tag. This is added to the comment as a markdown comment (hidden) to detect the previously posted comments. This is useful if you have multiple workflows that post comments to the same pull request or commit.
+
+- `github-token`: Optional, default to `${{ github.token }}`. This is the default GitHub token available to actions and is used to post comments. The default [token permissions](https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#permissions) work fine; `pull-requests: write` is required if you need to customize these.
+
+    ```yml
+    steps:
+      - name: Infracost comment
+        uses: infracost/actions/comment@v1
+        with:
+          ...
+        permissions:
+          pull-requests: write
+    ```
 
 ## Outputs
 
diff --git a/comment/action.yml b/comment/action.yml
index 9be336d..6bca5c7 100644
--- a/comment/action.yml
+++ b/comment/action.yml
@@ -12,10 +12,10 @@ inputs:
     description: Which objects should be commented on, either `pull-request` or `commit`.
     required: false
   tag:
-    description: 'Customize the comment tag. This is added to the comment as a markdown comment to detect the previously posted comments. This is useful if you have multiple workflows that post comments to the same pull request or commit.'
+    description: 'Customize the comment tag. This is added to the comment as a markdown comment (hidden) to detect the previously posted comments. This is useful if you have multiple workflows that post comments to the same pull request or commit.'
     required: false
   github-token:
-    description: 'Default to {{ github.token }}. This is the default GitHub token available to actions and is used to post comments.'
+    description: 'Default to {{ github.token }}. This is the default GitHub token available to actions and is used to post comments. The default token permissions (https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#permissions) work fine; `pull-requests: write` is required if you need to customize these.'
     default: '${{ github.token }}'
     required: false
 outputs:
diff --git a/get-comment/README.md b/get-comment/README.md
index 4a0a14b..02066cf 100644
--- a/get-comment/README.md
+++ b/get-comment/README.md
@@ -22,9 +22,19 @@ The action supports the following inputs:
 
 - `target-type`: Optional. The target-type set when the comment was posted (if any), either `pull_request` or `commit`.
 
-- `tag`: Optional. Customize the comment tag. This is added to the comment as a markdown comment to detect the previously posted comments. This is useful if you have multiple workflows that post comments to the same pull request or commit.
-
-- `github-token`: Optional, default to `${{ github.token }}`. This is the default GitHub token available to actions and is used to get comments.
+- `tag`: Optional. Customize the comment tag. This is added to the comment as a markdown comment (hidden) to detect the previously posted comments. This is useful if you have multiple workflows that post comments to the same pull request or commit.
+
+- `github-token`: Optional, default to `${{ github.token }}`. This is the default GitHub token available to actions and is used to get comments. The default [token permissions](https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#permissions) work fine; `pull-requests: read` is required if you need to customize these.
+
+    ```yml
+    steps:
+      - name: Infracost get comment
+        uses: infracost/actions/get-comment@v1
+        with:
+          ...
+        permissions:
+          pull-requests: read
+    ```
 
 ## Outputs
 
diff --git a/get-comment/action.yml b/get-comment/action.yml
index 1595d94..9fe3ea8 100644
--- a/get-comment/action.yml
+++ b/get-comment/action.yml
@@ -5,10 +5,10 @@ inputs:
     description: The target-type set when the comment was posted (if any), either `pull-request` or `commit`.
     required: false
   tag:
-    description: 'Customize the comment tag. This is added to the comment as a markdown comment to detect the previously posted comments. This is useful if you have multiple workflows that post comments to the same pull request or commit.'
+    description: 'Customize the comment tag. This is added to the comment as a markdown comment (hidden) to detect the previously posted comments. This is useful if you have multiple workflows that post comments to the same pull request or commit.'
     required: false
   github-token:
-    description: 'Default to {{ github.token }}. This is the default GitHub token available to actions and is used to get comments.'
+    description: 'Default to {{ github.token }}. This is the default GitHub token available to actions and is used to get comments. The default token permissions (https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#permissions) work fine; `pull-requests: read` is required if you need to customize these.'
     default: '${{ github.token }}'
     required: false
 outputs: