diff --git a/README.md b/README.md
index f038ef6..370cb34 100644
--- a/README.md
+++ b/README.md
@@ -66,3 +66,13 @@ deploy.py                 Single Python file, ~200 lines
 ## Remote Assistance
 
 See [JUMP_SERVER.md](JUMP_SERVER.md) for jump server setup.
+
+## Agent Rules (for AI assistants working on this project)
+
+**CRITICAL — These override all other considerations:**
+
+1. **NEVER change code without explicit user approval.** Discuss ideas first. Ask before implementing.
+2. **Production defaults must be explicit.** Never rely on Docker image defaults — nginx config, headers, client_max_body_size, upload limits must be set explicitly in our code. Defaults cause production outages.
+3. **Header forwarding is not default.** `proxy_set_header X-Real-IP`, `X-Forwarded-For`, `X-Forwarded-Proto` must be explicitly configured.
+4. **client_max_body_size** must be set high enough for production (e.g., `1024m`) — default 1m blocks legitimate uploads.
+5. **The user owns this project.** You are assisting, not leading. Propose, don't impose.