diff --git a/ssh/agent/keyring.go b/ssh/agent/keyring.go
index 75328bb..a9e29b6 100644
--- a/ssh/agent/keyring.go
+++ b/ssh/agent/keyring.go
@@ -32,8 +32,10 @@ type keyring struct {
 
 var errLocked = errors.New("agent: locked")
 
-// NewKeyring returns an Agent that holds keys in memory.  It is safe
-// for concurrent use by multiple goroutines.
+// NewKeyring returns an Agent that holds keys in memory.  It is safe for
+// concurrent use by multiple goroutines.
+//
+// The returned Agent only supports the "lifetime" constraint.
 func NewKeyring() Agent {
 	return &keyring{}
 }
@@ -146,7 +148,8 @@ func (r *keyring) List() ([]*Key, error) {
 // Add adds a private key to the keyring. If a certificate is given, that
 // certificate is added as public key.
 //
-// Add returns an error if key contains ConstraintExtensions.
+// Add returns an error if key contains ConstraintExtensions or
+// ConfirmBeforeUse.
 func (r *keyring) Add(key AddedKey) error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
@@ -154,6 +157,10 @@ func (r *keyring) Add(key AddedKey) error {
 		return errLocked
 	}
 
+	if key.ConfirmBeforeUse {
+		return errors.New("agent: confirm before use constraint is not supported")
+	}
+
 	if len(key.ConstraintExtensions) > 0 {
 		return errors.New("agent: constraint extensions are present but not supported")
 	}
diff --git a/ssh/agent/keyring_test.go b/ssh/agent/keyring_test.go
index 6c08252..f120392 100644
--- a/ssh/agent/keyring_test.go
+++ b/ssh/agent/keyring_test.go
@@ -144,3 +144,18 @@ func TestAddKeyWithConstraints(t *testing.T) {
 		t.Fatal("adding a key with unsupported constraints succeeded")
 	}
 }
+
+func TestAddKeyWithConfirmBeforeUse(t *testing.T) {
+	agent, cleanup := startKeyringAgent(t)
+	defer cleanup()
+
+	key := testPrivateKeys["rsa"]
+
+	err := agent.Add(AddedKey{
+		PrivateKey:       key,
+		ConfirmBeforeUse: true,
+	})
+	if err == nil {
+		t.Fatal("adding a key with confirm before use constraint succeeded")
+	}
+}
diff --git a/ssh/test/agent_unix_test.go b/ssh/test/agent_unix_test.go
index 9257bfe..fb99c90 100644
--- a/ssh/test/agent_unix_test.go
+++ b/ssh/test/agent_unix_test.go
@@ -24,9 +24,8 @@ func TestAgentForward(t *testing.T) {
 		t.Fatalf("Error adding key: %s", err)
 	}
 	if err := keyring.Add(agent.AddedKey{
-		PrivateKey:       testPrivateKeys["ecdsa"],
-		ConfirmBeforeUse: true,
-		LifetimeSecs:     3600,
+		PrivateKey:   testPrivateKeys["ecdsa"],
+		LifetimeSecs: 3600,
 	}); err != nil {
 		t.Fatalf("Error adding key with constraints: %s", err)
 	}