diff --git a/active/software_pi/pi.md b/active/software_pi/pi.md
index b61ce6d..c479eb9 100644
--- a/active/software_pi/pi.md
+++ b/active/software_pi/pi.md
@@ -68,3 +68,45 @@ This is my ~/.pi/agent/models.json
   }
 }
 ```
+
+## Installing for sysadmin work
+
+I would absolutely recommend installing pi under a special user (I call mine
+`ops`) with limited sudoers access that you tightly control. Pair that with the
+following AGENTS.md at `/home/ops/AGENTS.md`:
+
+```text
+# AGENTS.md
+
+## Sudo policy
+
+The `ops` user on this machine has **limited sudoers capabilities**. The exact
+allowlist is discoverable at any time with:
+
+sudo -l
+
+Allowed (NOPASSWD) commands currently include: `hostnamectl hostname`, `reboot`,
+`dnf update/upgrade/install/remove/clean/makecache/autoremove`,
+`dnf config-manager addrepo`, `systemctl start/restart/reload/enable`,
+`firewall-cmd`, the ansible shim, `qemu-img`, `virsh`, `virt-install`,
+`composer-cli`, `getfacl`, specific `setfacl` invocations,
+`/usr/local/sbin/osbuild-auto.sh`, and `btrfs scrub`.
+
+## Rule for agents
+
+If you (the agent) believe you need a permission that is **not** in the
+`sudo -l` allowlist — i.e., a command fails with a sudo permission error, or a
+task requires root access you do not have — you must:
+
+1. **Stop** and do not attempt workarounds that bypass sudo (no password
+   guessing, no escalating via other users, no trying to write to root-owned
+   paths without permission).
+2. **Ask the human** to update sudoers with the specific command(s) you need,
+   stating exactly which command(s) and arguments should be added so the user
+   can review and approve them. Requests must be correct and copy-pastable,
+   using full command paths in standard sudoers format, e.g.
+   `ops ALL=(root) NOPASSWD: /usr/sbin/btrfs scrub*`
+
+Do not proceed with root-only operations until the user has confirmed the
+sudoers entries have been added.
+```
\ No newline at end of file