diff --git a/AGENTS.md b/AGENTS.md
index 1d1cbbd6a..5e9e8a8f7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -48,6 +48,24 @@ Tests use build tags with different timeouts:
   compatibility (e.g., `quay.io/enterprise-contract/ec-cli`, Tekton parameter names) must be
   preserved as-is.
 
+## Go file header convention
+
+Go source files in this repository place the SPDX license header comment
+before the `//go:build` tag. This is the established convention across
+all Go files — do not flag build tag placement as a style violation.
+
+## Security fix review expectations
+
+Security bug fixes and vulnerability mitigations (PRs labeled `bug` +
+`Possible security concern`, or referencing security-related Jira tickets
+like EC-1842) should not be blocked on documentation updates.
+
+Documentation gaps in files like `THREAT_MODEL.md`, `DESIGN.md`, and
+user-facing docs should be flagged as informational comments (not
+blocking change requests) when the PR's primary purpose is a security
+fix. Authors are expected to create follow-up issues or PRs for
+documentation updates after the security fix is merged.
+
 ## CGO and DNS Resolution
 
 Binaries are built with `CGO_ENABLED=0` for portability. This uses Go's native DNS resolver,