diff --git a/AGENTS.md b/AGENTS.md
index d2bce19..eaef775 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -50,6 +50,15 @@ The self-hosted runner is required because the workflow needs SSH access to the
 The shared workflow fetches the canonical pre-commit config at runtime; this
 repository does not provide a tracked copy.
 
+Same-repository pull requests run tests followed by a credentialed `make plan`;
+fork pull requests run tests only. Every push to `main` performs a fresh live
+`make apply` after the `production` environment gate. The apply does not reuse
+the pull-request plan.
+
+`README.md` is wholly generated by terraform-docs in `replace` mode. Put
+operational guidance in this file rather than appending hand-written sections
+to `README.md`, because the next terraform-docs run will remove them.
+
 ## Local apply
 
 `make init` / `make plan` / `make apply` need: