diff --git a/buds/02.md b/buds/02.md
index 8ddc18f..3461f45 100644
--- a/buds/02.md
+++ b/buds/02.md
@@ -103,6 +103,10 @@ Servers should perform additional checks on the authorization event
 1. The `t` tag must be set to `delete`
 2. MUST contain at least one `x` tag matching the sha256 hash of the blob being deleted
 
+When multiple `x` tags are present on the authorization event the server MUST only delete the blob listed in the URL.
+
+**Multiple `x` tags MUST NOT be interpreted as the user requesting a bulk delete.**
+
 Example Authorization event:
 
 ```json