diff --git a/ai/shared.md b/ai/shared.md
index 71256ea..cc85dd1 100644
--- a/ai/shared.md
+++ b/ai/shared.md
@@ -24,6 +24,11 @@ guides (`backend-context.md`, `frontend-context.md`) extend these.
   possible - do not split lines unnecessarily
 - Variable names: use explicit, descriptive names - never single-letter or
   abbreviated variables (e.g. `$text` not `$t`, `$node` not `$n`)
+- Method/function/constructor parameters: do not use default values - every
+  call site must pass every argument explicitly. This eliminates a class of
+  bugs where an unintended default silently slips through (e.g. an
+  `isAdmin=false` or an empty `passwordHash`). Apply the same rule in tests
+  and fakes - if a helper accepts a value, every caller must supply it.
 - First, explore the codebase to understand existing patterns - look at similar
   files for reference before writing anything
 - Never use em dashes (—) in code, comments, or docblocks - use hyphens (-)