diff --git a/AGENTS.md b/AGENTS.md
index ee1267e..d3b080e 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -81,3 +81,11 @@ python worker.py --worker  # start RQ worker listening on geocrop_tasks queue
 - **Secrets**: Managed via Kubernetes Secrets (e.g., `geocrop-secrets`, `geocrop-db-secret`).
 
 
+
+### 🛑 STRICT ENGINEERING POLICY
+* All approved changes MUST be committed and pushed to Gitea.
+* All deployments MUST occur ONLY through the CI/CD pipeline via ArgoCD.
+* Direct manual server modifications are forbidden.
+* No bypassing ArgoCD.
+* No hotfixes directly on running containers.
+* Infrastructure state must remain GitOps-managed.
diff --git a/CLAUDE.md b/CLAUDE.md
index 6c70b2e..8b1af71 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -68,3 +68,11 @@ cd apps/worker && python worker.py --worker
 - `training/`: Model training scripts and research.
 - `plan/`: Architectural blueprints and restructuring reports.
 - `ops/`: Infrastructure scripts and data migration tools.
+
+### 🛑 STRICT ENGINEERING POLICY
+* All approved changes MUST be committed and pushed to Gitea.
+* All deployments MUST occur ONLY through the CI/CD pipeline via ArgoCD.
+* Direct manual server modifications are forbidden.
+* No bypassing ArgoCD.
+* No hotfixes directly on running containers.
+* Infrastructure state must remain GitOps-managed.
diff --git a/GEMINI.md b/GEMINI.md
index 18675f3..8989278 100644
--- a/GEMINI.md
+++ b/GEMINI.md
@@ -80,3 +80,11 @@ kubectl apply -k k8s/base/
 - **Jupyter**: `lab.techarvest.co.zw`
 - **Tiler**: `tiles.portfolio.techarvest.co.zw`
 - **MinIO**: `minio.portfolio.techarvest.co.zw`
+
+### 🛑 STRICT ENGINEERING POLICY
+* All approved changes MUST be committed and pushed to Gitea.
+* All deployments MUST occur ONLY through the CI/CD pipeline via ArgoCD.
+* Direct manual server modifications are forbidden.
+* No bypassing ArgoCD.
+* No hotfixes directly on running containers.
+* Infrastructure state must remain GitOps-managed.