diff --git a/AGENTS.md b/AGENTS.md
index 1b4b1d6..60531d1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -20,6 +20,14 @@ This document provides workspace-level instructions for AI agents working anywhe
 - For VM power or maintenance requests, act only on the exact VM names provided by the operator.
 - If any requested VM name is not found, stop and report it; do not infer, substitute, or search for replacement VMs unless the operator explicitly asks for that discovery step.
 
+## ATVM vCenter Inventory Deletion Guardrail
+
+- Never delete or destroy any ATVM VM from vCenter. Removing from inventory or unregistering is allowed only for VMs whose names start with `atvm`.
+- Treat a vCenter VM as protected ATVM inventory if its name starts with `atvm`, if it resides on an `AutomatedTest-*` ATVM datastore, or if it is an ATVM platform/controller VM, even when it is not listed in `inventory/vm-inventory.md`.
+- ATVM VM inventory entries in vCenter are permanent test inventory and must be preserved even when power, maintenance, datastore, or cleanup work is requested.
+- This guardrail applies regardless of operator wording unless the operator explicitly updates this AGENTS.md rule first.
+- For cleanup workflows, only power off, detach/unmount supporting resources, unregister/remove from inventory for VMs whose names start with `atvm`, or report the needed manual action; do not delete or destroy ATVM VMs.
+
 ## Red Hat Manual Task Subscription Guardrail
 
 - For manually requested tasks on Red Hat machines (non-ATVM-automation tasks), run the Red Hat subscription reset/register sequence before the requested task.
diff --git a/atvm/AGENTS.md b/atvm/AGENTS.md
index 645d996..f34c9a4 100644
--- a/atvm/AGENTS.md
+++ b/atvm/AGENTS.md
@@ -104,6 +104,11 @@ This file defines how to operate and maintain the ATVM workspace in `/home/aw/co
 - For vCenter VM snapshot requests, default the snapshot name to `VM Snapshot [mm/dd/yyyy:hh:mm:ss AM/PM]` in the local `America/New_York` timezone unless the operator explicitly requests a different name.
 - For VM power, shutdown, startup, snapshot, or maintenance requests, operate only on the exact VM names provided by the operator.
 - If any requested VM name is missing or not found, stop immediately and report the missing names; do not infer, substitute, or search for replacement VMs unless the operator explicitly requests a discovery/mapping step.
+- Never delete or destroy any ATVM VM from vCenter. Removing from inventory or unregistering is allowed only for VMs whose names start with `atvm`.
+- Treat a vCenter VM as protected ATVM inventory if its name starts with `atvm`, if it resides on an `AutomatedTest-*` ATVM datastore, or if it is an ATVM platform/controller VM, even when it is not listed in `inventory/vm-inventory.md`.
+- ATVM VM inventory entries in vCenter are permanent test inventory and must be preserved even when power, maintenance, datastore, or cleanup work is requested.
+- This vCenter inventory deletion guardrail applies regardless of operator wording unless the operator explicitly updates this AGENTS.md rule first.
+- For cleanup workflows, only power off, detach/unmount supporting resources, unregister/remove from inventory for VMs whose names start with `atvm`, or report the needed manual action; do not delete or destroy ATVM VMs.
 - For `atvm_prep` requests, infer common option values from operator shorthand when intent is clear.
 - For any `atvm_prep` execution request, always present the exact planned `atvm_prep.py` command first and wait for explicit operator approval before running it.
 - Always execute `atvm_prep.py` on the ATVM Cypress controller host `192.168.3.190` (`atvm-cypres-vm-1`).