Thank you for your suggestions.
We have now moved the files to under Contents/Resources/
For entitlement we attempted to remove all from the file to isolate the issue, and removed provisioning profile to avoid mismatches.
<plist version="1.0">
<dict>
</dict>
</plist>
This still result in same results of "Operation not permitted'
Is the provisioning profile always required?
btw, do we have more things to check for what operations was being not permitted? Thanks