diff --git a/AGENTS.md b/AGENTS.md
index 1c3a48b..ac3d222 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,5 +1,7 @@
 # Agent Guidelines
 
+> CREDS-PATTERN-RETIRED 2026-09-06 (founder): all secrets live in the TSGCOO Bitwarden vault via the KNELSecretsManager Go CLI — `sm env creds/<name>` (see /data2/TSGCOO/.local/bin/sm). Command examples below showing `--env-file ~/.creds/...` are HISTORICAL; translate to `sm env` before reuse. Cloudron account identities (ic-builder/ic-reviewer/manager-tsg/vptechops) author all work — never the founder account.
+
 ## Agent Authority (NON-NEGOTIABLE)
 
 **No work is permissible on any system without an approved Redmine ticket.