diff --git a/AGENTS.md b/AGENTS.md
index 88686365b0..1ae3fcc8f0 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -37,4 +37,4 @@ Public, open-source home of `@pascal-app/{core,viewer,editor,nodes,mcp,cli,ifc-c
 - No compatibility shims, dead code or speculative abstractions; comments only for a non-obvious *why*.
 - Old scenes must still load after your change (E-003).
 - Never cite private-repo plan paths from this repo (E-015).
-- A bot may merge its own PR once required CI is green and a review from a different bot, on the current head, approves with no unresolved P0/P1 comments. Anything touching auth, payments, secrets, infra, moderation, user data or schema migrations needs the Security bot's review; otherwise a Codex, Cursor or relevant fleet bot review is enough. A human is still required for secrets or keys, billing or spend, new access, sign-ins or 2FA, permanently deleting production data, and anything sent externally under a person's name. CI stays required: never weaken or skip checks.
+- Claude Code, Codex and other local coding agents work within the user's requested scope. An agent may merge its own PR with green required CI on the current head, any GitHub-required reviews satisfied, and no unresolved P0/P1 comments. Honor requests to leave work for review or unmerged. No named bot, bot label or external approval service is required. Human authorization remains required for secrets or keys, billing or spend, new access, sign-ins or 2FA, destructive or access-widening production data changes, and anything sent externally under a person's name; do not ask again when already authorized. CI stays required: never weaken, skip or bypass checks or branch protection.