diff --git a/src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs b/src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs
index e5760e43..d05d5abf 100644
--- a/src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs
+++ b/src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs
@@ -243,8 +243,9 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
         if (_dataPlaneAuthorizer is { Enabled: true })
         {
             _logger.LogWarning(
-                "OtOpcUaServerHostedService: node ACL enforcement is ENABLED — writes, alarm commands and "
-                + "HistoryRead now require a matching NodeAcl grant. Read, Browse and Subscribe remain ungated.");
+                "OtOpcUaServerHostedService: node ACL enforcement is ENABLED — EVERY data-plane operation "
+                + "(read, browse, subscribe, write, alarm commands, HistoryRead) now requires a matching "
+                + "NodeAcl grant. A principal with no grant can connect and see nothing.");
         }
 
         // Propagate the configured tie-cluster over-fetch bound onto the node manager so HistoryRead-Raw