diff --git a/boss/SKILL.md b/boss/SKILL.md
index ded18fd..bb4effd 100644
--- a/boss/SKILL.md
+++ b/boss/SKILL.md
@@ -61,7 +61,11 @@ A NEW CYCLE NEVER STARTS AUTONOMOUSLY — IT IS A BOUNCE-BACK.
 
 Universal rules (only-orchestrator-commits, main-is-sacrosanct,
 language, RED-first for bugs) come from the project's `CLAUDE.md`
-and apply regardless of mode. This skill does not restate them.
+— and from the user-level `~/.claude/CLAUDE.md` identity/security
+layer above it, loaded in every session. Both bind regardless of
+mode; autonomy does not lift a user-level constraint (e.g. an
+external-service-consent rule that names `/boss` explicitly). This
+skill does not restate them.
 
 ## The Process
 
@@ -343,6 +347,10 @@ actionable ask, not a wrap-up summary.
 - **Universal rules:** the project's `CLAUDE.md` — orchestrator
   role boundaries, commit discipline, design rationale,
   authority over skills, feature acceptance, RED-first for bugs.
+  Plus the user-level `~/.claude/CLAUDE.md` (identity/security
+  layer, loaded in every session, above the project file) — it
+  carries constraints that bind autonomous runs too, including
+  external-service-consent rules that `/boss` does not lift.
 - **Queue:** the URL configured under `git.issue_tracker.url` in
   the profile; CLI command at `git.issue_tracker.list_cmd`.
 - **Glossary write-rule:** `../docs/glossary-convention.md` —