diff --git a/AGENTS.md b/AGENTS.md
index ee1430b..81d8b41 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -46,6 +46,10 @@ Restrict Slack access with `SLACK_ALLOWED_USER_ID` and `SLACK_ALLOWED_CHANNEL_ID
 ## Git & Gitea Workflow Notes
 Use `tea` (Gitea CLI), not `gh`.
 
+Hard rule:
+- Never implement changes, stage files, or commit on `main`.
+- Always create/use a feature branch first, and merge via PR.
+
 - Check login:
   - `tea login ls`
   - `tea whoami`