doc: describe how the permission model grants the entrypoint

doc/api/cli.md

@@ -297,8 +297,10 @@ The valid arguments for the `--allow-fs-read` flag are:
 
 Examples can be found in the [File System Permissions][] documentation.
 
-The initializer module and custom `--require` modules has a implicit
-read permission.
+The initializer module and custom `--require` modules have an implicit
+read permission. The entrypoint is granted as passed on the command line,
+without the module loader's resolution; see the [File System Permissions][]
+documentation for details.
 
 ```console
 $ node --permission -r custom-require.js -r custom-require-2.js index.js

doc/api/permissions.md

@@ -238,6 +238,13 @@ $ node -r /path/to/custom-require.js --permission index.js
   list.
 * `index.js` will be included in the allowed file system read list.
 
+The entrypoint is granted as passed on the command line, without the module
+loader's resolution. If it is a directory, such as in `node --permission .`,
+read access is granted to everything inside that directory, recursively. If it
+omits the file extension, such as in `node --permission index`, the resolved
+`index.js` is not granted. Pass the full path of the file, or use
+[`--allow-fs-read`][], to grant exactly what the application needs.
+
 The valid arguments for both flags are:
 
 * `*` - To allow all `FileSystemRead` or `FileSystemWrite` operations,