diff --git a/docs/BROWSERROT-PLAN.md b/docs/BROWSERROT-PLAN.md
index 32a27f3..454df38 100644
--- a/docs/BROWSERROT-PLAN.md
+++ b/docs/BROWSERROT-PLAN.md
@@ -39,11 +39,15 @@ Node dependency, isolated behind an interface and a local socket.
 ## 1. Non-negotiable reframe (carry into every task)
 
 incredigo is **not** a bot-bypass/scraping tool. Per CLAUDE.md Hard Rule 5:
-- **Self-owned accounts only, with the user's authorization.**
-- **Never bypass MFA / CAPTCHA / email-confirm** — when one appears, the success marker
-  simply doesn't match, `Rotate` fails cleanly, the OLD secret is kept, and the human is
-  handed the change-URL by the existing worklist. (Already how `Rotate` behaves,
-  browserrot.go:175-180.)
+- **Authorized principals only** — self-owned, or a client's delegated + *recorded* consent.
+  The invariant is provable, per-credential, auditable authorization, not operator ownership;
+  managed client rotation is in scope on that basis.
+- **Never bypass, harvest, auto-submit, or simulate any second factor** (MFA / CAPTCHA /
+  OTP / push / email-confirm) — when one appears, the success marker simply doesn't match,
+  `Rotate` fails cleanly, the OLD secret is kept, and the challenge is handed to the **live
+  account holder** to complete before the flow resumes. (Already how `Rotate` behaves,
+  browserrot.go:175-180.) The two primitives a takeover/stuffing kit needs — unauthorized
+  scale + an automated second-factor defeat — are structurally absent and must stay absent.
 - "Stealth" here = **do not get false-flagged as a bot while doing a legitimate self-login**,
   NOT defeating a challenge. For a user logging into their own account from their own machine,
   most of the anti-bot arms race is already moot (real IP, real device, real user).