---
title: "Keep security and account messages on · Agent Wranglers"
url: https://agentwranglers.se/playbook/notifications/channels-and-preferences/mandatory-account-messages
id: NTF-40
level: Recommended
applies: accounts
updated: 2026-10-27
build: a2a6bdfed830
tokens: 921
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep security and account messages on

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Channels and preferences](https://agentwranglers.se/playbook/notifications/channels-and-preferences.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: NTF-40
- Level: Recommended
- Chapter: [Channels and preferences](https://agentwranglers.se/playbook/notifications/channels-and-preferences.md)
- Rule: Mark security and account notices as mandatory in the catalogue. Deliver each one on at least one channel, even when the person turned every optional type off.
- Check: A test turns off every preference for a user, then changes the account email. The old address still gets the notice. A catalogue test fails if a type marked mandatory has no channel the person cannot switch off.
- Applies when: The project has user accounts.
- How: These are the messages an attacker hopes the owner never sees. They cover a new sign-in, a password or email change, and a new second factor or passkey. They also cover a new API key and a changed payout account. Let people pick which channel they arrive on, but never offer a switch that turns them off everywhere. Show them on the settings page as "always on", with the reason. Keep them free of marketing, so no unsubscribe rule applies, as [Have consent before any marketing message](https://agentwranglers.se/playbook/notifications/channels-and-preferences/marketing-consent.md) says. Which events count is set in [Tell people about every change to their sign-in](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/security-notifications.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
export function channelsForMandatory(type, chosen) {
  if (!type.mandatory) return chosen;
  return chosen.length ? chosen : [type.fallbackChannel ?? 'email'];
}
```

### Python example

```python
def channels_for_mandatory(kind, chosen: list[str]) -> list[str]:
    if not kind.mandatory:
        return chosen
    return chosen or [kind.fallback_channel or "email"]
```

## Related rules

- NTF-3 [Let people choose per type and channel](https://agentwranglers.se/playbook/notifications/channels-and-preferences/notification-preferences.md) in Notifications
- NTF-2 [Have consent before any marketing message](https://agentwranglers.se/playbook/notifications/channels-and-preferences/marketing-consent.md) in Notifications
- ACC-22 [Tell people about every change to their sign-in](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/security-notifications.md) in Accounts and identity

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/notifications/channels-and-preferences/mandatory-account-messages">Agent Wranglers notifications playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Let people choose per type and channel](https://agentwranglers.se/playbook/notifications/channels-and-preferences/notification-preferences.md)
- Next: [Send one message per event](https://agentwranglers.se/playbook/notifications/channels-and-preferences/one-message-per-event.md)
- [Channels and preferences](https://agentwranglers.se/playbook/notifications/channels-and-preferences.md)