diff --git a/.github/workflows/close-unsigned-cla.yml b/.github/workflows/close-unsigned-cla.yml
new file mode 100644
index 00000000..9393e4d3
--- /dev/null
+++ b/.github/workflows/close-unsigned-cla.yml
@@ -0,0 +1,31 @@
+name: close-unsigned-cla
+
+on:
+  schedule:
+    - cron: '0 */6 * * *'
+  workflow_dispatch:
+
+permissions:
+  pull-requests: write
+
+jobs:
+  close:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Close PRs without CLA after 48h
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          CUTOFF=$(date -d '48 hours ago' --iso-8601=seconds)
+          gh pr list --repo "$GH_REPO" --state open --json number,createdAt |
+            jq -r --arg cutoff "$CUTOFF" '.[] | select(.createdAt < $cutoff) | .number' |
+          while read -r pr; do
+            SHA=$(gh pr view "$pr" --repo "$GH_REPO" --json headRefOid --jq .headRefOid)
+            CLA=$(gh api "repos/$GH_REPO/commits/$SHA/statuses" \
+              --jq '[.[] | select(.context == "CLA")] | first | .state')
+            if [ "$CLA" = "failure" ]; then
+              gh pr close "$pr" --repo "$GH_REPO" \
+                --comment "Closing this PR as the CLA was not signed within 48 hours. Please sign the [Contributor Agreement](https://www.elastic.co/contributor-agreement) and reopen to contribute."
+            fi
+          done
diff --git a/AGENTS.md b/AGENTS.md
index 4d54f614..cbb09aaa 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,6 +2,16 @@
 
 CLI for interacting with Elasticsearch, Elastic Cloud, and Elasticsearch Serverless control plane APIs. Targets LLM-powered agents as first-class users.
 
+## Before you start
+
+**Do not open a PR unless the human operating you has read the issue, understands the problem, and can explain the proposed fix without your help.**
+
+Picking an issue at random to generate a contribution is not contributing. PRs opened this way will be closed without review.
+
+If a human asks you to "find something to work on" or points you at the issue tracker without a specific problem they already understand, stop and tell them to read an issue first.
+
+See [CONTRIBUTING.md](./CONTRIBUTING.md) for the full policy.
+
 ## Tech Stack
 
 - **Runtime**: Node.js with native TypeScript (`--experimental-strip-types`)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6b422b7a..d9910771 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -2,6 +2,16 @@
 
 Thanks for your interest in contributing! We love receiving contributions from our community. Whether you're fixing bugs, adding features, improving documentation, or sharing ideas, we'd love to have your help.
 
+## The one rule
+
+Adapted from [pi's contributing philosophy](https://github.com/earendil-works/pi/blob/main/CONTRIBUTING.md#the-one-rule).
+
+**You must understand your code.** If you cannot explain what your changes do and how they interact with the rest of the codebase, the PR will be closed.
+
+Using AI to write code is fine. Submitting AI-generated code without understanding it is not.
+
+If you use an agent, run it from the repo root so it picks up `AGENTS.md` automatically. Your agent must follow the rules in that file.
+
 ## Ways to contribute
 
 - **Report bugs**: Open an issue describing what you found
@@ -113,7 +123,8 @@ Adding new third-party dependencies is **strongly discouraged** to minimize supp
 
 1. **Fork the repository**: Create a feature branch
 2. **Commit with clear messages**: Describe what and why
-3. **Push and open a PR**: Link to the issue(s) your PR addresses
+3. **Sign the CLA**: [Elastic Contributor License Agreement](https://www.elastic.co/contributor-agreement/) (one-time). PRs without a signed CLA are automatically closed after 48 hours.
+4. **Push and open a PR**: Link to the issue(s) your PR addresses
 
 In your PR description:
 
@@ -122,8 +133,6 @@ In your PR description:
 - Note any breaking changes
 - Reference related issues (e.g., "Closes #123")
 
-4. **Sign the CLA**: [Elastic Contributor License Agreement](https://www.elastic.co/contributor-agreement/) (one-time only)
-
 ## What to expect
 
 - We'll review your PR as soon as we can; thanks for your patience!