diff --git a/README.md b/README.md
index 2cde17a..4793535 100644
--- a/README.md
+++ b/README.md
@@ -573,7 +573,8 @@ Granular permissions mode provides service-by-service scope control:
 - Gmail levels: `readonly`, `organize`, `drafts`, `send`, `full` (cumulative)
 - Other services currently support: `readonly`, `full`
 - `--permissions` and `--read-only` are mutually exclusive
-- With `--tool-tier`, only tier-matched tools are enabled and only services with matching tier tools are imported
+- `--permissions` cannot be combined with `--tools`; enabled services are determined by the `--permissions` entries (optionally filtered by `--tool-tier`)
+- With `--tool-tier`, only tier-matched tools are enabled and only services that have tools in the selected tier are imported
 
 **★ Tool Tiers**
 ```bash
diff --git a/auth/permissions.py b/auth/permissions.py
index 98de857..caa38d0 100644
--- a/auth/permissions.py
+++ b/auth/permissions.py
@@ -179,7 +179,7 @@ def get_scopes_for_permission(service: str, level: str) -> List[str]:
             f"Valid levels: {valid}"
         )
 
-    return list(set(cumulative))
+    return sorted(set(cumulative))
 
 
 def get_all_permission_scopes() -> List[str]:
diff --git a/main.py b/main.py
index 03021e8..8fb97c5 100644
--- a/main.py
+++ b/main.py
@@ -190,7 +190,7 @@ def main():
             "Example: --permissions gmail:organize drive:readonly. "
             "Gmail levels: readonly, organize, drafts, send, full (cumulative). "
             "Other services: readonly, full. "
-            "Mutually exclusive with --read-only."
+            "Mutually exclusive with --read-only and --tools."
         ),
     )
     args = parser.parse_args()