diff --git a/server/src/routes/agents.ts b/server/src/routes/agents.ts
index fda62a3c213..b0ba4ecfcdb 100644
--- a/server/src/routes/agents.ts
+++ b/server/src/routes/agents.ts
@@ -1694,6 +1694,10 @@ export function agentRoutes(db: Db) {
   });
 
   router.patch("/agents/:id/instructions-path", validate(updateAgentInstructionsPathSchema), async (req, res) => {
+    if (req.actor.type !== "board") {
+      throw forbidden("Only board-authenticated callers can manage instructions path or bundle configuration");
+    }
+
     const id = req.params.id as string;
     const existing = await svc.getById(id);
     if (!existing) {