diff --git a/pkg/server/api/connect/v1/v1_resolver.go b/pkg/server/api/connect/v1/v1_resolver.go
index 11e29db17..b5f13d9d6 100644
--- a/pkg/server/api/connect/v1/v1_resolver.go
+++ b/pkg/server/api/connect/v1/v1_resolver.go
@@ -11,6 +11,7 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/99designs/gqlgen/graphql"
 	"github.com/vektah/gqlparser/v2/gqlerror"
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/coredata"
@@ -146,8 +147,26 @@ func (r *identityResolver) Permission(ctx context.Context, obj *types.Identity,
 			Action:    action,
 		},
 	)
+
 	if err != nil {
-		return false, nil
+		var errInsufficientPermissions *iam.ErrInsufficientPermissions
+		if errors.As(err, &errInsufficientPermissions) {
+			graphql.AddError(
+				ctx,
+				&gqlerror.Error{
+					Path:    graphql.GetPath(ctx),
+					Message: err.Error(),
+					Extensions: map[string]interface{}{
+						"code": "UNAUTHORIZED",
+					},
+				},
+			)
+
+			return false, nil
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot authorize", log.Error(err))
+		return false, gqlutils.InternalServerError(ctx)
 	}
 
 	return true, nil