diff --git a/MPF.md b/MPF.md
index ab16f649bf..6e3097fbf6 100644
--- a/MPF.md
+++ b/MPF.md
@@ -1945,6 +1945,26 @@ Primarily for developer convenience, this setting allows you to easily disable t
 
 * Added in CFEngine 3.12.0
 
+### Enable permission enforcement for files under WORKDIR/share/GUI
+
+The MPF used to actively enforce permissions of files and directories under `$(sys.workdir)/share/GUI`, to re-enable this active permission enforcement define the class `default:mpf_enforce_workdir_share_gui_perms`.
+
+For example, to define it via Augments for CFEngine Enterprise Hubs:
+
+```json
+{
+  "classes": {
+    "default:mpf_enforce_workdir_share_gui_perms": {
+      "class_expressions": [
+        "enterprise_edition.am_policy_hub::"
+      ]
+    }
+  }
+}
+```
+
+* Added in CFEngine 3.27.0
+
 ### Configure Enterprise Mission Portal Apache SSLProtocol
 
 This directive can be used to control which versions of the SSL/TLS protocol will be accepted in new connections.
diff --git a/cfe_internal/enterprise/CFE_knowledge.cf b/cfe_internal/enterprise/CFE_knowledge.cf
index cf6d53ec58..2fd13a2838 100644
--- a/cfe_internal/enterprise/CFE_knowledge.cf
+++ b/cfe_internal/enterprise/CFE_knowledge.cf
@@ -346,12 +346,13 @@ bundle agent cfe_internal_setup_knowledge
                     $(def.cf_apache_user) then users will not be able to change
                     ldap settings.";
 
-
       "$(sys.workdir)/share/GUI/."
+        handle => "cfe_internal_setup_knowledge_files_workdir_share_gui_perms",
         perms => mog("0400", "root", "root" ),
         depth_search => recurse_basedir("inf"),
-        comment => "No Mission Portal code in share needs to be accessed by
-                    anyone";
+        comment => concat( "No Mission Portal code in share needs to be accessed",
+                           " by anyone" ),
+        if => "mpf_enforce_workdir_share_gui_perms";
 
       "$(sys.workdir)/." -> { "ENT-3299" }
         perms => mog("755", "root", "root"),