diff --git a/AGENTS.md b/AGENTS.md
index 379f459..627fc83 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -21,6 +21,19 @@ Always let the user review the proposed commit scope and commit message first, a
 - For VM power or maintenance requests, act only on the exact VM names provided by the operator.
 - If any requested VM name is not found, stop and report it; do not infer, substitute, or search for replacement VMs unless the operator explicitly asks for that discovery step.
 
+## Red Hat Manual Task Subscription Guardrail
+
+- For manually requested tasks on Red Hat machines (non-ATVM-automation tasks), run the Red Hat subscription reset/register sequence before the requested task.
+- Do not apply this guardrail to ATVM automation runs where existing automation scripts already handle subscription flow.
+- Use Red Hat subscription credentials from `/home/aw/code/cds/.env.credentials.local`:
+  - `REDHAT_SUBSCRIPTION_USER`
+  - `REDHAT_SUBSCRIPTION_PASSWORD`
+- Required pre-task command sequence for manual Red Hat tasks:
+  - `subscription-manager remove --all`
+  - `subscription-manager unregister`
+  - `subscription-manager clean`
+  - `subscription-manager register --username "$REDHAT_SUBSCRIPTION_USER" --password "$REDHAT_SUBSCRIPTION_PASSWORD"`
+
 ## ATVM Prep Mapping Defaults
 
 - For `atvm_prep` requests in this workspace, infer common options from operator shorthand when intent is clear.