diff --git a/.changeset/30863-skills-ai-delete-record-confirm.md b/.changeset/30863-skills-ai-delete-record-confirm.md
new file mode 100644
index 00000000000..764679cb9c1
--- /dev/null
+++ b/.changeset/30863-skills-ai-delete-record-confirm.md
@@ -0,0 +1,8 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): the `objectstack-ai` skill's MCP tools table now teaches that `delete_record` needs `confirm: true` — a call without it is refused with `ACTION_CONFIRMATION_REQUIRED` (428), so the agent asks the human first, then retries. The row said only that `delete_record` is annotated destructive, so an agent following it was refused since the MCP tool started requiring confirmation.
+
+Clause-②: no
+Metadata-protocol: none
diff --git a/skills/objectstack-ai/SKILL.md b/skills/objectstack-ai/SKILL.md
index acf4002ffeb..0c825865a04 100644
--- a/skills/objectstack-ai/SKILL.md
+++ b/skills/objectstack-ai/SKILL.md
@@ -199,7 +199,7 @@ permissions and row-level security:
 | `query_records`, `get_record` | reads — filter, field selection, sorting, pagination |
 | `aggregate_records` | GROUP BY totals; registered only when the data bridge implements `aggregate` |
 | `validate_expression` | build-accurate CEL check before a formula is authored into metadata |
-| `create_record`, `update_record`, `delete_record` | writes; `delete_record` is annotated destructive |
+| `create_record`, `update_record`, `delete_record` | writes; `delete_record` is refused with `ACTION_CONFIRMATION_REQUIRED` (428) unless it sends `confirm: true` — ask the human first, then retry |
 | `list_actions`, `run_action` | your AI-exposed business Actions — the same `ai.exposed` opt-in as above |
 
 ---