diff --git a/backend/llm.txt b/backend/llm.txt
index 01009b6..2f829a3 100644
--- a/backend/llm.txt
+++ b/backend/llm.txt
@@ -215,6 +215,10 @@ Generator will convert snake_case columns to Go struct field names (e.g. `class_
 ## 3) Service layer injection (when adding services)
 
 - Services are in `backend/app/services`.
+- Data access boundary:
+  - MUST: only the `services` layer may query the database via `models.*Query`, `models.Q.*`, `gorm.DB`, or raw SQL.
+  - DO NOT: perform any direct database query from HTTP modules (`backend/app/http/**`) including controllers, DTO binders, or middlewares.
+  - HTTP modules must call `services.*` for all read/write operations.
 - After creating/updating a service provider, regenerate wiring:
 - `atomctl gen service`
 - `atomctl gen provider`