diff --git a/skills/oci-deal-accelerator/SKILL.md b/skills/oci-deal-accelerator/SKILL.md
index bcdec6e..753a603 100644
--- a/skills/oci-deal-accelerator/SKILL.md
+++ b/skills/oci-deal-accelerator/SKILL.md
@@ -36,4 +36,16 @@ Additional knowledge-base resources exposed by the same MCP server:
 
 ## Fallback behavior
 
-If `skill://methodology` cannot be read (MCP unreachable, auth expired, etc.), fall back to: discover customer intent in natural language, select the most specific tool from the table above, and confirm assumptions with the user before generating artifacts. Never invent SKUs or services the user did not request.
+If any MCP call returns `Auth required` (or the server is unreachable), **STOP immediately**. Surface a single clear message to the user:
+
+> The OCI Deal Accelerator MCP session is not authenticated. Run `codex mcp login oci-deal-accelerator` in a separate terminal, then restart Codex. I will retry once you confirm.
+
+Do **NOT**:
+- attempt to reconstruct `kb://*` resources by searching the local workspace — the knowledge base lives **server-side only** and is never present in any cloned repo, plugin cache, or skill directory;
+- invent SKUs, pricing, service names, or quantities to fill the gap;
+- generate partial artifacts (deck, BOM, diagram) using inferred data;
+- retry the same tool call more than once before surfacing the fix to the user.
+
+Exploration of the local filesystem on auth failure wastes context and produces wrong answers. Fail fast, surface the command, wait for the user.
+
+If the resource `skill://methodology` IS readable but a specific downstream tool fails, continue the conversation using the methodology's guidance — the guardrail above applies only to blanket MCP connectivity/auth failures.