diff --git a/pkg/server/api/authz/authorization.go b/pkg/server/api/authz/authorization.go
index 057591d2e..c41ced426 100644
--- a/pkg/server/api/authz/authorization.go
+++ b/pkg/server/api/authz/authorization.go
@@ -19,6 +19,7 @@ import (
 	"errors"
 
 	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam"
 	"go.probo.inc/probo/pkg/server/api/authn"
@@ -82,6 +83,10 @@ func NewAuthorizeFunc(
 				return gqlutils.Forbidden(ctx, err)
 			}
 
+			if errors.Is(err, coredata.ErrResourceNotFound) {
+				return gqlutils.NotFoundf(ctx, "resource not found")
+			}
+
 			logger.ErrorCtx(ctx, "cannot authorize", log.Error(err))
 			return gqlutils.Internal(ctx)
 		}