diff --git a/templates/manifest.example.yaml b/templates/manifest.example.yaml
index 0f27e46..5a869c6 100644
--- a/templates/manifest.example.yaml
+++ b/templates/manifest.example.yaml
@@ -59,10 +59,38 @@ commands:
   #                 its removal, blocklists, exclusions, deletes, identity and
   #                 credential operations, running code on a host
   # --- Request-based command (recommended: declarative, no sandbox) ---------
+  #
+  # `category` says what the command is FOR. It is what the agent browses the
+  # estate by: an analyst who wants to decode a rewritten URL and one who wants
+  # to isolate a host are not looking in the same place, and every command of
+  # your integration shares the manifest-level `category` above, which describes
+  # the PRODUCT and cannot separate them.
+  #
+  # Optional. A command that declares none is classified from its id and
+  # description when Riposte projects it into an agent tool — a decent guess,
+  # and no more than that. Declaring it stops the guessing for that command,
+  # which is the point of the field: you know, the classifier infers.
+  #
+  #   enrich     reputation or analysis of an indicator by a third party
+  #   hunt       search telemetry: events, logs, process trees
+  #   inspect    fetch one object in detail — a detection, a host, a record
+  #   transform  decode, defang, parse, extract — acting on data, not on an estate
+  #   collect    gather artefacts: jobs, forensic packages, dumps
+  #   contain    isolate, block, quarantine, suspend
+  #   remediate  undo a control or delete: unisolate, unblock, restore, purge
+  #   identity   accounts: disable, reset a password, revoke a session
+  #   notify     send a message, an e-mail, a page
+  #   ticket     create or update a ticket or a case
+  #   manage     policies, exclusions, configuration, agent lifecycle
+  #
+  # A value outside this list is ignored and the command is classified instead,
+  # so a typo costs the declaration rather than inventing a category nothing
+  # else ever lands in.
   - id: lookup
     name: Lookup indicator
     description: Fetches a report for an indicator over HTTP.
     risk: read                 # required in practice · read | safe_write | destructive
+    category: enrich           # optional · what the command is FOR (see above)
     inputs_schema:
       properties:
         indicator: