diff --git a/docs/specs/RFC-025-AGENT-EXPERIENCE.md b/docs/specs/RFC-025-AGENT-EXPERIENCE.md
index ec0b9be..38bd027 100644
--- a/docs/specs/RFC-025-AGENT-EXPERIENCE.md
+++ b/docs/specs/RFC-025-AGENT-EXPERIENCE.md
@@ -402,6 +402,7 @@ Core primitives become mechanical code review rules. An agent reviewing a diff c
 | `os/exec` | Bypasses Process primitive | `c.Process().Run()` |
 | `unsafe` | Bypasses Fs sandbox | `Fs.NewUnrestricted()` |
 | `encoding/json` | Bypasses Core serialisation | `core.JSONMarshal()` / `core.JSONUnmarshal()` |
+| `os` | Bypasses Fs/Env primitives | `c.Fs()`, `core.Env()`, `core.DirFS()` |
 | `path/filepath` | Bypasses path security boundary | `core.Path()` / `core.JoinPath()` |
 | `fmt.Errorf` | Bypasses error primitive | `core.E()` |
 | `errors` | Bypasses error primitive | `core.NewError()` / `core.Is()` / `core.As()` |