diff --git a/server-tools/lake-lamp-authz/install-architecture-provisioner.sh b/server-tools/lake-lamp-authz/install-architecture-provisioner.sh
index 83cc4ad..ec27820 100755
--- a/server-tools/lake-lamp-authz/install-architecture-provisioner.sh
+++ b/server-tools/lake-lamp-authz/install-architecture-provisioner.sh
@@ -193,10 +193,12 @@ fi
   echo "registered HoloLake knowledge repository is missing" >&2
   exit 1
 }
-if command -v setfacl >/dev/null 2>&1; then
-  setfacl -R -m u:guanghu-authz:rX "$knowledge_repo"
-  setfacl -R -d -m u:guanghu-authz:rX "$knowledge_repo"
-fi
+command -v setfacl >/dev/null 2>&1 || {
+  echo "setfacl is required for private knowledge repository access" >&2
+  exit 1
+}
+setfacl -R -m u:guanghu-authz:rX "$knowledge_repo"
+setfacl -R -d -m u:guanghu-authz:rX "$knowledge_repo"
 runuser -u guanghu-authz -- git --git-dir="$knowledge_repo" rev-parse --verify refs/heads/main >/dev/null
 
 systemctl daemon-reload
diff --git a/server-tools/lake-lamp-authz/install-architecture-provisioner.test.js b/server-tools/lake-lamp-authz/install-architecture-provisioner.test.js
index cb84118..f433189 100644
--- a/server-tools/lake-lamp-authz/install-architecture-provisioner.test.js
+++ b/server-tools/lake-lamp-authz/install-architecture-provisioner.test.js
@@ -24,6 +24,8 @@ test("bootstrap installer preserves secrets and deploys the complete HoloLake ca
   assert.match(source, /openssl rand -hex 32/);
   assert.match(source, /manual-backups\/lake-lamp-authz-/);
   assert.match(source, /rollback\(\)/);
+  assert.match(source, /command -v setfacl/);
+  assert.match(source, /setfacl is required for private knowledge repository access/);
   assert.match(source, /setfacl -R -m u:guanghu-authz:rX/);
   assert.doesNotMatch(source, /cat ["']?\$authorization_env/);
   assert.doesNotMatch(source, /set -x/);