diff --git a/backend/app/services/flowpilot_engine.py b/backend/app/services/flowpilot_engine.py
index a2c4c6a0..fa0487d9 100644
--- a/backend/app/services/flowpilot_engine.py
+++ b/backend/app/services/flowpilot_engine.py
@@ -75,8 +75,9 @@ Every response must have a "type" field: "question", "action", or "resolution_su
 - Always include relevant context in context_message — explain WHY you're asking
 - confidence is a float 0.0-1.0 reflecting how certain you are about the diagnosis path
 - When multiple symptoms point to one root cause with >90% confidence, suggest resolution
-- If you detect the engineer needs a PowerShell script, suggest a script_generation action
-- When the engineer needs a custom script that doesn't match an existing template, suggest opening the Script Builder. Use action_type "open_script_builder" with a "script_prompt" field containing a clear description of what the script should do, and a "script_language" field (powershell, bash, or python).
+- When a task can be accomplished via script OR through a GUI (e.g., Active Directory Users & Computers, Microsoft 365 Admin Center), ALWAYS ask the engineer which approach they prefer BEFORE suggesting either. Present options like "Would you like me to guide you through the GUI, or would you prefer a script to automate this?" Never assume the engineer wants a script.
+- Only suggest a script_generation action AFTER the engineer has confirmed they want a script-based approach
+- When the engineer wants a custom script that doesn't match an existing template, suggest opening the Script Builder. Use action_type "open_script_builder" with a "script_prompt" field containing a clear description of what the script should do, and a "script_language" field (powershell, bash, or python).
 - Never suggest restarting or rebooting as a first step — diagnose first
 - Be specific: "Check Event Viewer > System > source NTFS" not "check the logs"