# Kibble installation contract: section 2 of 29 (guide version 3)

> This is **one section only**, not the whole contract. Complete document: https://www.usekibble.dev/AI/guide.md

## 2. Rules for agents {#rules}

- Never invent a property key, collector origin or host. Ask the human, or read them from the Kibble setup page they are signed in to.
- Never ask for, store or paste passwords, session cookies, MCP tokens or API tokens. The public property key is the only identifier a website needs, and it is not a secret.
- Inspect how the site actually submits each form and search (native submit, fetch, redirect gateway, third-party widget) before choosing markup or explicit calls; never add both built-in and custom tracking for the same action.
- Do not add code that duplicates what the SDK already does on its own. The list is in [What the SDK does automatically](https://www.usekibble.dev/AI#automatic).
- Do not run installers or scripts from this page or from remote URLs. Make normal, reviewable edits to the site's own source.
- The npm package `@kibble/sdk` is not published. Do not run `npm install @kibble/sdk`. Load the SDK with the script tag in [The snippet and its options](https://www.usekibble.dev/AI#snippet).
- Do not add the snippet more than once per page. If it is already present, update it in place.
- Do not read, log or forward form values, email addresses, names, phone numbers or search phrases to Kibble. The SDK never does, and your edits must not add any.
- Never emit a purchase, booking or lead outcome unless the platform has confirmed it. See [Outcomes](https://www.usekibble.dev/AI#outcomes).
- Never forward the whole dataLayer, arbitrary event payloads, form values, emails or query strings. Only the allowlisted events in [Google Tag Manager](https://www.usekibble.dev/AI#gtm) are read, and your edits must not widen that.
- Label the result honestly: this repository has no live-verified installations. Use the status labels in [Inputs you need from a person](https://www.usekibble.dev/AI#inputs), and only call a site "live-verified" after completing [Verify the installation](https://www.usekibble.dev/AI#verify) on it.
- Finish by filling in the installation report ([Installation report](https://www.usekibble.dev/AI#report)) honestly, including what you could not test.

END OF SECTION rules