diff --git a/README.md b/README.md
index df10d8d..8629fbe 100644
--- a/README.md
+++ b/README.md
@@ -57,8 +57,10 @@ Shared CI runs the repository and internal skill suites on all three platforms.
 The personal instruction applies a minimal workflow across ordinary
 repositories: preserve raw operator wording, search bounded session history for
 named recurring systems, use direct tools first, and delegate only bounded
-mechanical evidence work to non-Claude workers. It does not require a planner,
-evidence mode, packet, receipt, fixed model role, or coordinator.
+mechanical evidence work to non-Claude workers. It permits auto-merge only for
+pull requests authored by `SFenton`; every other author's pull request requires
+a manual merge. It does not require a planner, evidence mode, packet, receipt,
+fixed model role, or coordinator.
 
 This is instruction- and settings-based behavior, not an installed `/plugin`
 package or a billing/security interceptor. The managed `settings.json` keys set
diff --git a/instructions/budget-workflow.instructions.md b/instructions/budget-workflow.instructions.md
index 0d25e6f..f856503 100644
--- a/instructions/budget-workflow.instructions.md
+++ b/instructions/budget-workflow.instructions.md
@@ -11,6 +11,13 @@ Follow the current repository's safety, authorization, testing, release, and
 domain-ownership rules. Advice and research do not authorize implementation,
 live mutation, deployment, release, destructive work, or permission changes.
 
+## Pull request merge safety
+
+- Enable or preserve auto-merge only when the pull request author is exactly
+  `SFenton`.
+- Never enable or re-enable auto-merge for pull requests authored by anyone
+  else, including bots. Those pull requests require a manual merge.
+
 ## Preserve meaning and continuity
 
 - Preserve the operator's exact wording until evidence supports a more specific
diff --git a/tests/minimal-policy.test.mjs b/tests/minimal-policy.test.mjs
index 177c5b6..a9cbc5a 100644
--- a/tests/minimal-policy.test.mjs
+++ b/tests/minimal-policy.test.mjs
@@ -18,6 +18,8 @@ test('default instruction keeps semantic ownership and targeted continuity', ()
   assert.match(instruction, /bounded session-history search/i);
   assert.match(instruction, /Delegate only bounded mechanical evidence work/i);
   assert.match(instruction, /Do not use\s+Claude models/i);
+  assert.match(instruction, /auto-merge only when the pull request author is exactly\s+`SFenton`/i);
+  assert.match(instruction, /including bots[\s\S]*manual merge/i);
 
   assert.doesNotMatch(instruction, /opportunities\.mjs plan/i);
   assert.doesNotMatch(instruction, /frontier models never perform/i);