diff --git a/seapp_contexts b/seapp_contexts
index 26d0c8f..2d00dda 100644
--- a/seapp_contexts
+++ b/seapp_contexts
@@ -1,5 +1,6 @@
 # Input selectors:
 #	isSystemServer (boolean)
+#	isOwner (boolean)
 #	user (string)
 #	seinfo (string)
 #	name (string)
@@ -7,6 +8,9 @@
 #	sebool (string)
 # isSystemServer=true can only be used once.
 # An unspecified isSystemServer defaults to false.
+# isOwner=true will only match for the owner/primary user.
+# isOwner=false will only match for secondary users.
+# If unspecified, the entry can match either case.
 # An unspecified string selector will match any value.
 # A user string selector that ends in * will perform a prefix match.
 # user=_app will match any regular app UID.
@@ -16,13 +20,14 @@
 #
 # Precedence rules:
 # 	  (1) isSystemServer=true before isSystemServer=false.
-#	  (2) Specified user= string before unspecified user= string.
-#	  (3) Fixed user= string before user= prefix (i.e. ending in *).
-#	  (4) Longer user= prefix before shorter user= prefix.
-#	  (5) Specified seinfo= string before unspecified seinfo= string.
-#	  (6) Specified name= string before unspecified name= string.
-#	  (7) Specified path= string before unspecified path= string.
-#	  (8) Specified sebool= string before unspecified sebool= string.
+# 	  (2) Specified isOwner= before unspecified isOwner= boolean.
+#	  (3) Specified user= string before unspecified user= string.
+#	  (4) Fixed user= string before user= prefix (i.e. ending in *).
+#	  (5) Longer user= prefix before shorter user= prefix.
+#	  (6) Specified seinfo= string before unspecified seinfo= string.
+#	  (7) Specified name= string before unspecified name= string.
+#	  (8) Specified path= string before unspecified path= string.
+#	  (9) Specified sebool= string before unspecified sebool= string.
 #
 # Outputs:
 #	domain (string)