diff --git a/docs/changelog.rst b/docs/changelog.rst
index af3d2a0b..04ce9583 100644
--- a/docs/changelog.rst
+++ b/docs/changelog.rst
@@ -610,7 +610,7 @@ JavaScript modules
 
 To use modules, JavaScript needs to be included in ``<script>`` tags with a ``type="module"`` attribute.
 
-Datasette now has the ability to output ``<script type="module">`` in places where you may wish to take advantage of modules. The ``extra_js_urls`` option described in :ref:`customization_css_and_javascript` can now be used with modules, and module support is also available for the :ref:`extra_body_script() <plugin_hook_extra_body_script>` plugin hook. (:issue:`1186`, :issue:`1187`)
+Datasette now has the ability to output ``<script type="module">`` in places where you may wish to take advantage of modules. The ``extra_js_urls`` option described in :ref:`configuration_reference_css_js` can now be used with modules, and module support is also available for the :ref:`extra_body_script() <plugin_hook_extra_body_script>` plugin hook. (:issue:`1186`, :issue:`1187`)
 
 `datasette-leaflet-freedraw <https://datasette.io/plugins/datasette-leaflet-freedraw>`__ is the first example of a Datasette plugin that takes advantage of the new support for JavaScript modules. See `Drawing shapes on a map to query a SpatiaLite database <https://simonwillison.net/2021/Jan/24/drawing-shapes-spatialite/>`__ for more on this plugin.
 
diff --git a/docs/configuration.rst b/docs/configuration.rst
index b22eacaa..a835ace9 100644
--- a/docs/configuration.rst
+++ b/docs/configuration.rst
@@ -5,18 +5,20 @@ Configuration
 
 Datasette offers several ways to configure your Datasette instances: server settings, plugin configuration, authentication, and more.
 
-To facilitate this, You can provide a ``datasette.yaml`` configuration file to datasette with the ``--config``/ ``-c`` flag:
+Most configuration can be handled using a ``datasette.yaml`` configuration file, passed to datasette using the ``--config``/ ``-c`` flag:
 
 .. code-block:: bash
 
     datasette mydatabase.db --config datasette.yaml
 
+This file can also use JSON, as ``datasette.json``. YAML is recommended over JSON due to its support for comments and multi-line strings.
+
 .. _configuration_reference:
 
-``datasette.yaml`` Reference
+``datasette.yaml`` reference
 ----------------------------
 
-Here's a full example of all the valid configuration options that can exist inside ``datasette.yaml``.
+This example shows many of the valid configuration options that can exist inside ``datasette.yaml``.
 
 .. [[[cog
     from metadata_doc import config_example
@@ -43,6 +45,9 @@ Here's a full example of all the valid configuration options that can exist insi
                 key: valueA
             tables:
               your_table_name:
+                allow:
+                  # Only the root user can access this table
+                  id: root
                 # plugin configuration for the your_table_name table
                 # inside your_db_name database
                 plugins:
@@ -77,6 +82,9 @@ Here's a full example of all the valid configuration options that can exist insi
                 key: valueA
             tables:
               your_table_name:
+                allow:
+                  # Only the root user can access this table
+                  id: root
                 # plugin configuration for the your_table_name table
                 # inside your_db_name database
                 plugins:
@@ -108,6 +116,9 @@ Here's a full example of all the valid configuration options that can exist insi
               },
               "tables": {
                 "your_table_name": {
+                  "allow": {
+                    "id": "root"
+                  },
                   "plugins": {
                     "datasette-my-plugin": {
                       "key": "valueB"
@@ -121,10 +132,11 @@ Here's a full example of all the valid configuration options that can exist insi
 .. [[[end]]]
 
 .. _configuration_reference_settings:
-Settings configuration
-~~~~~~~~~~~~~~~~~~~~~~
 
-:ref:`settings` can be configured in ``datasette.yaml`` with the ``settings`` key.
+Settings
+~~~~~~~~
+
+:ref:`settings` can be configured in ``datasette.yaml`` with the ``settings`` key:
 
 .. [[[cog
     from metadata_doc import config_example
@@ -160,11 +172,16 @@ Settings configuration
         }
 .. [[[end]]]
 
+The full list of settings is available in the :ref:`settings documentation <settings>`. Settings can also be passed to Datasette using one or more ``--setting name value`` command line options.`
+
 .. _configuration_reference_plugins:
+
 Plugin configuration
 ~~~~~~~~~~~~~~~~~~~~
 
-Configuration for plugins can be defined inside ``datasette.yaml``. For top-level plugin configuration, use the ``plugins`` key.
+:ref:`Datasette plugins <plugins>` often require configuration. This plugin configuration should be placed in ``plugins`` keys inside ``datasette.yaml``.
+
+Most plugins are configured at the top-level of the file, using the ``plugins`` key:
 
 .. [[[cog
     from metadata_doc import config_example
@@ -201,7 +218,7 @@ Configuration for plugins can be defined inside ``datasette.yaml``. For top-leve
         }
 .. [[[end]]]
 
-For database level or table level plugin configuration, nest it under the appropriate place under ``databases``.
+Some plugins can be configured at the database or table level. These should use a ``plugins`` key nested under the appropriate place within the ``databases`` object:
 
 .. [[[cog
     from metadata_doc import config_example
@@ -275,19 +292,273 @@ For database level or table level plugin configuration, nest it under the approp
 
 
 .. _configuration_reference_permissions:
+
 Permissions configuration
 ~~~~~~~~~~~~~~~~~~~~~~~~~
 
-TODO
+Datasette's :ref:`authentication and permissions <authentication>` system can also be configured using ``datasette.yaml``.
+
+Here is a simple example:
+
+.. [[[cog
+    from metadata_doc import config_example
+    import textwrap
+    config_example(cog, textwrap.dedent(
+      """
+        # Instance is only available to users 'sharon' and 'percy':
+        allow:
+          id:
+          - sharon
+          - percy
+
+        # Only 'percy' is allowed access to the accounting database:
+        databases:
+          accounting:
+            allow:
+              id: percy
+      """).strip()
+      )
+.. ]]]
+
+.. tab:: datasette.yaml
+
+    .. code-block:: yaml
+
+        # Instance is only available to users 'sharon' and 'percy':
+        allow:
+          id:
+          - sharon
+          - percy
+
+        # Only 'percy' is allowed access to the accounting database:
+        databases:
+          accounting:
+            allow:
+              id: percy
+
+.. tab:: datasette.json
+
+    .. code-block:: json
+
+        {
+          "allow": {
+            "id": [
+              "sharon",
+              "percy"
+            ]
+          },
+          "databases": {
+            "accounting": {
+              "allow": {
+                "id": "percy"
+              }
+            }
+          }
+        }
+.. [[[end]]]
+
+:ref:`authentication_permissions_config` has the full details.
 
 .. _configuration_reference_canned_queries:
+
 Canned queries configuration
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-TODO
+:ref:`Canned queries <canned_queries>` are named SQL queries that appear in the Datasette interface. They can be configured in ``datasette.yaml`` using the ``queries`` key at the database level:
+
+.. [[[cog
+    from metadata_doc import config_example, config_example
+    config_example(cog, {
+        "databases": {
+           "sf-trees": {
+               "queries": {
+                   "just_species": {
+                       "sql": "select qSpecies from Street_Tree_List"
+                   }
+               }
+           }
+        }
+    })
+.. ]]]
+
+.. tab:: datasette.yaml
+
+    .. code-block:: yaml
+
+        databases:
+          sf-trees:
+            queries:
+              just_species:
+                sql: select qSpecies from Street_Tree_List
+
+
+.. tab:: datasette.json
+
+    .. code-block:: json
+
+        {
+          "databases": {
+            "sf-trees": {
+              "queries": {
+                "just_species": {
+                  "sql": "select qSpecies from Street_Tree_List"
+                }
+              }
+            }
+          }
+        }
+.. [[[end]]]
+
+See the :ref:`canned queries documentation <canned_queries>` for more, including how to configure :ref:`writable canned queries <canned_queries_writable>`.
 
 .. _configuration_reference_css_js:
-Extra CSS and JS configuration
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-TODO
+Custom CSS and JavaScript
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Datasette can load additional CSS and JavaScript files, configured in ``datasette.yaml`` like this:
+
+.. [[[cog
+    from metadata_doc import config_example
+    config_example(cog, """
+        extra_css_urls:
+        - https://simonwillison.net/static/css/all.bf8cd891642c.css
+        extra_js_urls:
+        - https://code.jquery.com/jquery-3.2.1.slim.min.js
+    """)
+.. ]]]
+
+.. tab:: datasette.yaml
+
+    .. code-block:: yaml
+
+
+            extra_css_urls:
+            - https://simonwillison.net/static/css/all.bf8cd891642c.css
+            extra_js_urls:
+            - https://code.jquery.com/jquery-3.2.1.slim.min.js
+
+
+.. tab:: datasette.json
+
+    .. code-block:: json
+
+        {
+          "extra_css_urls": [
+            "https://simonwillison.net/static/css/all.bf8cd891642c.css"
+          ],
+          "extra_js_urls": [
+            "https://code.jquery.com/jquery-3.2.1.slim.min.js"
+          ]
+        }
+.. [[[end]]]
+
+The extra CSS and JavaScript files will be linked in the ``<head>`` of every page:
+
+.. code-block:: html
+
+    <link rel="stylesheet" href="https://simonwillison.net/static/css/all.bf8cd891642c.css">
+    <script src="https://code.jquery.com/jquery-3.2.1.slim.min.js"></script>
+
+You can also specify a SRI (subresource integrity hash) for these assets:
+
+.. [[[cog
+    config_example(cog, """
+        extra_css_urls:
+        - url: https://simonwillison.net/static/css/all.bf8cd891642c.css
+          sri: sha384-9qIZekWUyjCyDIf2YK1FRoKiPJq4PHt6tp/ulnuuyRBvazd0hG7pWbE99zvwSznI
+        extra_js_urls:
+        - url: https://code.jquery.com/jquery-3.2.1.slim.min.js
+          sri: sha256-k2WSCIexGzOj3Euiig+TlR8gA0EmPjuc79OEeY5L45g=
+    """)
+.. ]]]
+
+.. tab:: datasette.yaml
+
+    .. code-block:: yaml
+
+
+            extra_css_urls:
+            - url: https://simonwillison.net/static/css/all.bf8cd891642c.css
+              sri: sha384-9qIZekWUyjCyDIf2YK1FRoKiPJq4PHt6tp/ulnuuyRBvazd0hG7pWbE99zvwSznI
+            extra_js_urls:
+            - url: https://code.jquery.com/jquery-3.2.1.slim.min.js
+              sri: sha256-k2WSCIexGzOj3Euiig+TlR8gA0EmPjuc79OEeY5L45g=
+
+
+.. tab:: datasette.json
+
+    .. code-block:: json
+
+        {
+          "extra_css_urls": [
+            {
+              "url": "https://simonwillison.net/static/css/all.bf8cd891642c.css",
+              "sri": "sha384-9qIZekWUyjCyDIf2YK1FRoKiPJq4PHt6tp/ulnuuyRBvazd0hG7pWbE99zvwSznI"
+            }
+          ],
+          "extra_js_urls": [
+            {
+              "url": "https://code.jquery.com/jquery-3.2.1.slim.min.js",
+              "sri": "sha256-k2WSCIexGzOj3Euiig+TlR8gA0EmPjuc79OEeY5L45g="
+            }
+          ]
+        }
+.. [[[end]]]
+
+This will produce:
+
+.. code-block:: html
+
+    <link rel="stylesheet" href="https://simonwillison.net/static/css/all.bf8cd891642c.css"
+        integrity="sha384-9qIZekWUyjCyDIf2YK1FRoKiPJq4PHt6tp/ulnuuyRBvazd0hG7pWbE99zvwSznI"
+        crossorigin="anonymous">
+    <script src="https://code.jquery.com/jquery-3.2.1.slim.min.js"
+        integrity="sha256-k2WSCIexGzOj3Euiig+TlR8gA0EmPjuc79OEeY5L45g="
+        crossorigin="anonymous"></script>
+
+Modern browsers will only execute the stylesheet or JavaScript if the SRI hash
+matches the content served. You can generate hashes using `www.srihash.org <https://www.srihash.org/>`_
+
+Items in ``"extra_js_urls"`` can specify ``"module": true`` if they reference JavaScript that uses `JavaScript modules <https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Modules>`__. This configuration:
+
+.. [[[cog
+    config_example(cog, """
+        extra_js_urls:
+        - url: https://example.datasette.io/module.js
+          module: true
+    """)
+.. ]]]
+
+.. tab:: datasette.yaml
+
+    .. code-block:: yaml
+
+
+            extra_js_urls:
+            - url: https://example.datasette.io/module.js
+              module: true
+
+
+.. tab:: datasette.json
+
+    .. code-block:: json
+
+        {
+          "extra_js_urls": [
+            {
+              "url": "https://example.datasette.io/module.js",
+              "module": true
+            }
+          ]
+        }
+.. [[[end]]]
+
+Will produce this HTML:
+
+.. code-block:: html
+
+    <script type="module" src="https://example.datasette.io/module.js"></script>
+
+
+
diff --git a/docs/custom_templates.rst b/docs/custom_templates.rst
index d8e4ac96..534d8b33 100644
--- a/docs/custom_templates.rst
+++ b/docs/custom_templates.rst
@@ -5,159 +5,6 @@ Custom pages and templates
 
 Datasette provides a number of ways of customizing the way data is displayed.
 
-.. _customization_css_and_javascript:
-
-Custom CSS and JavaScript
--------------------------
-
-When you launch Datasette, you can specify a custom configuration file like this::
-
-    datasette mydb.db --config datasette.yaml
-
-Your ``datasette.yaml`` file can include links that look like this:
-
-.. [[[cog
-    from metadata_doc import config_example
-    config_example(cog, """
-        extra_css_urls:
-        - https://simonwillison.net/static/css/all.bf8cd891642c.css
-        extra_js_urls:
-        - https://code.jquery.com/jquery-3.2.1.slim.min.js
-    """)
-.. ]]]
-
-.. tab:: datasette.yaml
-
-    .. code-block:: yaml
-
-
-            extra_css_urls:
-            - https://simonwillison.net/static/css/all.bf8cd891642c.css
-            extra_js_urls:
-            - https://code.jquery.com/jquery-3.2.1.slim.min.js
-
-
-.. tab:: datasette.json
-
-    .. code-block:: json
-
-        {
-          "extra_css_urls": [
-            "https://simonwillison.net/static/css/all.bf8cd891642c.css"
-          ],
-          "extra_js_urls": [
-            "https://code.jquery.com/jquery-3.2.1.slim.min.js"
-          ]
-        }
-.. [[[end]]]
-
-The extra CSS and JavaScript files will be linked in the ``<head>`` of every page:
-
-.. code-block:: html
-
-    <link rel="stylesheet" href="https://simonwillison.net/static/css/all.bf8cd891642c.css">
-    <script src="https://code.jquery.com/jquery-3.2.1.slim.min.js"></script>
-
-You can also specify a SRI (subresource integrity hash) for these assets:
-
-.. [[[cog
-    config_example(cog, """
-        extra_css_urls:
-        - url: https://simonwillison.net/static/css/all.bf8cd891642c.css
-          sri: sha384-9qIZekWUyjCyDIf2YK1FRoKiPJq4PHt6tp/ulnuuyRBvazd0hG7pWbE99zvwSznI
-        extra_js_urls:
-        - url: https://code.jquery.com/jquery-3.2.1.slim.min.js
-          sri: sha256-k2WSCIexGzOj3Euiig+TlR8gA0EmPjuc79OEeY5L45g=
-    """)
-.. ]]]
-
-.. tab:: datasette.yaml
-
-    .. code-block:: yaml
-
-
-            extra_css_urls:
-            - url: https://simonwillison.net/static/css/all.bf8cd891642c.css
-              sri: sha384-9qIZekWUyjCyDIf2YK1FRoKiPJq4PHt6tp/ulnuuyRBvazd0hG7pWbE99zvwSznI
-            extra_js_urls:
-            - url: https://code.jquery.com/jquery-3.2.1.slim.min.js
-              sri: sha256-k2WSCIexGzOj3Euiig+TlR8gA0EmPjuc79OEeY5L45g=
-
-
-.. tab:: datasette.json
-
-    .. code-block:: json
-
-        {
-          "extra_css_urls": [
-            {
-              "url": "https://simonwillison.net/static/css/all.bf8cd891642c.css",
-              "sri": "sha384-9qIZekWUyjCyDIf2YK1FRoKiPJq4PHt6tp/ulnuuyRBvazd0hG7pWbE99zvwSznI"
-            }
-          ],
-          "extra_js_urls": [
-            {
-              "url": "https://code.jquery.com/jquery-3.2.1.slim.min.js",
-              "sri": "sha256-k2WSCIexGzOj3Euiig+TlR8gA0EmPjuc79OEeY5L45g="
-            }
-          ]
-        }
-.. [[[end]]]
-
-This will produce:
-
-.. code-block:: html
-
-    <link rel="stylesheet" href="https://simonwillison.net/static/css/all.bf8cd891642c.css"
-        integrity="sha384-9qIZekWUyjCyDIf2YK1FRoKiPJq4PHt6tp/ulnuuyRBvazd0hG7pWbE99zvwSznI"
-        crossorigin="anonymous">
-    <script src="https://code.jquery.com/jquery-3.2.1.slim.min.js"
-        integrity="sha256-k2WSCIexGzOj3Euiig+TlR8gA0EmPjuc79OEeY5L45g="
-        crossorigin="anonymous"></script>
-
-Modern browsers will only execute the stylesheet or JavaScript if the SRI hash
-matches the content served. You can generate hashes using `www.srihash.org <https://www.srihash.org/>`_
-
-Items in ``"extra_js_urls"`` can specify ``"module": true`` if they reference JavaScript that uses `JavaScript modules <https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Modules>`__. This configuration:
-
-.. [[[cog
-    config_example(cog, """
-        extra_js_urls:
-        - url: https://example.datasette.io/module.js
-          module: true
-    """)
-.. ]]]
-
-.. tab:: datasette.yaml
-
-    .. code-block:: yaml
-
-
-            extra_js_urls:
-            - url: https://example.datasette.io/module.js
-              module: true
-
-
-.. tab:: datasette.json
-
-    .. code-block:: json
-
-        {
-          "extra_js_urls": [
-            {
-              "url": "https://example.datasette.io/module.js",
-              "module": true
-            }
-          ]
-        }
-.. [[[end]]]
-
-Will produce this HTML:
-
-.. code-block:: html
-
-    <script type="module" src="https://example.datasette.io/module.js"></script>
-
 CSS classes on the <body>
 ~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -258,9 +105,10 @@ The following URLs will now serve the content from those CSS and JS files::
     http://localhost:8001/assets/styles.css
     http://localhost:8001/assets/app.js
 
-You can reference those files from ``datasette.yaml`` like so:
+You can reference those files from ``datasette.yaml`` like this, see :ref:`custom CSS and JavaScript <configuration_reference_css_js>` for more details:
 
 .. [[[cog
+    from metadata_doc import config_example
     config_example(cog, """
         extra_css_urls:
         - /assets/styles.css
diff --git a/docs/metadata_doc.py b/docs/metadata_doc.py
index a8f13414..ad85bf52 100644
--- a/docs/metadata_doc.py
+++ b/docs/metadata_doc.py
@@ -24,17 +24,19 @@ def metadata_example(cog, data=None, yaml=None):
     cog.out("\n")
 
 
-def config_example(cog, input):
+def config_example(
+    cog, input, yaml_title="datasette.yaml", json_title="datasette.json"
+):
     if type(input) is str:
         data = YAML().load(input)
         output_yaml = input
     else:
         data = input
         output_yaml = safe_dump(input, sort_keys=False)
-    cog.out("\n.. tab:: datasette.yaml\n\n")
+    cog.out("\n.. tab:: {}\n\n".format(yaml_title))
     cog.out("    .. code-block:: yaml\n\n")
     cog.out(textwrap.indent(output_yaml, "        "))
-    cog.out("\n\n.. tab:: datasette.json\n\n")
+    cog.out("\n\n.. tab:: {}\n\n".format(json_title))
     cog.out("    .. code-block:: json\n\n")
     cog.out(textwrap.indent(json.dumps(data, indent=2), "        "))
     cog.out("\n")
diff --git a/docs/plugin_hooks.rst b/docs/plugin_hooks.rst
index 1a88cd31..d9d135e5 100644
--- a/docs/plugin_hooks.rst
+++ b/docs/plugin_hooks.rst
@@ -270,7 +270,7 @@ you have one:
 
 Note that ``your-plugin`` here should be the hyphenated plugin name - the name that is displayed in the list on the ``/-/plugins`` debug page.
 
-If your code uses `JavaScript modules <https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Modules>`__ you should include the ``"module": True`` key. See :ref:`customization_css_and_javascript` for more details.
+If your code uses `JavaScript modules <https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Modules>`__ you should include the ``"module": True`` key. See :ref:`configuration_reference_css_js` for more details.
 
 .. code-block:: python
 
diff --git a/docs/plugins.rst b/docs/plugins.rst
index 1a72af95..03ddf8f0 100644
--- a/docs/plugins.rst
+++ b/docs/plugins.rst
@@ -328,7 +328,7 @@ To write that to a ``requirements.txt`` file, run this::
 Plugin configuration
 --------------------
 
-Plugins can have their own configuration, embedded in a :ref:`configuration` file. Configuration options for plugins live within a ``"plugins"`` key in that file, which can be included at the root, database or table level.
+Plugins can have their own configuration, embedded in a :ref:`configuration file <configuration>`. Configuration options for plugins live within a ``"plugins"`` key in that file, which can be included at the root, database or table level.
 
 Here is an example of some plugin configuration for a specific table: