diff --git a/AGENTS.md b/AGENTS.md
index ba7a565..8ffc768 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,5 +1,12 @@
 # AGENTS.md
 
+## §0 Secrets (HIGH — pointer)
+
+**Common SoT:** `$HOME/git/llm/llm-configs/operator-rules/secrets-policy.md` (`PATH[admin-secrets]`).  
+Secret **values** never enter chat/ctx as **input or output** (prompts, pasted tool results, commit subjects, admin-log prose). Handle via **scripts** only (disk `*.env`; report `STATUS=` / `KEY_PRESENT=` / paths) or else a **path-only local-model instruction**. Session stub: `$HOME/.grok/AGENTS.md` §0. Do not fork a second full copy here.
+
+---
+
 Session Must / Must not: `$HOME/.grok/AGENTS.md` only — do not duplicate.
 
 **Sync (must-sync trees / wenn Git allein nicht reicht):** siehe [SYNC.md](SYNC.md).