diff --git a/amp/images/keycloak-account-management.png b/amp/images/keycloak-account-management.png
new file mode 100644
index 0000000..1e1333e
--- /dev/null
+++ b/amp/images/keycloak-account-management.png
Binary files differ
diff --git a/amp/images/keycloak-login.png b/amp/images/keycloak-login.png
new file mode 100644
index 0000000..d273121
--- /dev/null
+++ b/amp/images/keycloak-login.png
Binary files differ
diff --git a/amp/images/ops-portal-api-key.png b/amp/images/ops-portal-api-key.png
new file mode 100644
index 0000000..ad3c9e1
--- /dev/null
+++ b/amp/images/ops-portal-api-key.png
Binary files differ
diff --git a/amp/images/ops-portal-login-details.png b/amp/images/ops-portal-login-details.png
new file mode 100644
index 0000000..e46cae6
--- /dev/null
+++ b/amp/images/ops-portal-login-details.png
Binary files differ
diff --git a/amp/roc.rst b/amp/roc.rst
index f1b9d3d..b241d79 100755
--- a/amp/roc.rst
+++ b/amp/roc.rst
@@ -298,4 +298,78 @@
    more structured approach for ROC.
 
 
+Operations Portal Usage
+-----------------------
 
+The Operations Portal is available as a web application, at a location defined in the Ingress of the Cluster.
+
+It is secured by SSL and an authentication system based on OpenID Connect. The implementation of this is through
+Keycloak, with users and groups defined in LDAP. It has a Role Based Access Control (RBAC) implementation based
+on Open Policy Agent (OPA).
+
+The Operations Portal is built on Angular 12 framework, and is compatible with the latest versions of:
+
+.. list-table:: Browser Compatibility
+   :widths: 40 60
+   :header-rows: 0
+
+   * - Google Chrome
+     - latest
+   * - Mozilla Firefox
+     - latest and extended support release (ESR)
+   * - Microsoft Edge
+     - 2 most recent major versions
+   * - Apple Safari
+     - 2 most recent major versions
+   * - Apple iOS
+     - 2 most recent major versions
+   * - Google Android
+     - 2 most recent major versions
+
+Logging in to the portal
+""""""""""""""""""""""""
+Navigating to the portal URL e.g. ``https://roc.<cluster-ingress-hostname>`` will briefly show
+an empty dashboard, before temporarily redirecting to the Authentication server's login
+page e.g. ``https://keycloak.ananki.io``
+
+.. image:: images/keycloak-login.png
+    :width: 800
+
+.. note:: The username and password are your Keycloak credentials - if you have forgotten
+    your password, please contact the system administrator.
+
+On entering the "username" and "password" you will be redirected to the dashboard.
+
+Clicking the user name in the drop down menu will display your name and the groups you belong to:
+
+.. image:: images/ops-portal-login-details.png
+    :width: 800
+
+.. note:: Click on the panel to dismiss it
+
+Clicking on the API Key, shows your Session API Key, along with the time it
+expires (in 24 hours time).
+
+.. image:: images/ops-portal-api-key.png
+    :width: 800
+
+Logging out of the portal
+"""""""""""""""""""""""""
+
+To log out of the portal click the "Sign Out" button at the end of the drop down menu.
+This releases all resources and redirects you to the Keycloak Account Management page,
+where you will have to click **Sign Out** to terminate the Keycloak session.
+
+.. image:: images/keycloak-account-management.png
+    :width: 800
+
+Before you "Sign Out", while still in this screen, it is possible to:
+
+* inspect your **Personal Info**,
+* configure ways to sign in
+* set up 2 factor authentication
+* change your password if required.
+* see your device activity
+
+.. note:: To return to the Operations Portal you can simply browse to the Portal's URL, or use the
+    browser's back button to return to the dashboard.
diff --git a/dict.txt b/dict.txt
index 409beac..af1dc65 100644
--- a/dict.txt
+++ b/dict.txt
@@ -95,6 +95,7 @@
 config
 configs
 controlplane
+coverages
 cpu
 daisyd
 dataplane
diff --git a/edge_deployment/site_planning.rst b/edge_deployment/site_planning.rst
index 278a50e..94d73ab 100644
--- a/edge_deployment/site_planning.rst
+++ b/edge_deployment/site_planning.rst
@@ -269,7 +269,7 @@
       router IP is ``10.0.1.126/25`` then ``RFC3442 Routes`` should be set to
       ``10.0.1.128\25`` (and the reverse - on ``10.0.1.254/25`` the ``RFC3442
       Routes`` would be set to be ``10.0.1.0/25``).  This creates an `RFC3442
-      Classless Static Route Option <https://tools.ietf.org/html/rfc3442>`_
+      Classless Static Route Option <https://datatracker.ietf.org/doc/html/rfc3442>`_
       for the subnet in DHCP.
 
 15. Add Cables between physical interfaces on the devices