diff --git a/pkg/coredata/trust_center_document_access.go b/pkg/coredata/trust_center_document_access.go
index 2555f7bda..bd593ed92 100644
--- a/pkg/coredata/trust_center_document_access.go
+++ b/pkg/coredata/trust_center_document_access.go
@@ -157,6 +157,10 @@ LIMIT 1;
 
 	access, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[TrustCenterDocumentAccess])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
 		return fmt.Errorf("cannot collect trust center document access: %w", err)
 	}
 
@@ -207,6 +211,10 @@ LIMIT 1;
 
 	access, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[TrustCenterDocumentAccess])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
 		return fmt.Errorf("cannot collect trust center document access: %w", err)
 	}
 
@@ -1037,6 +1045,7 @@ func (tcda *TrustCenterDocumentAccess) LoadByTrustCenterAccessIDAndTrustCenterFi
 	q := `
 SELECT
     id,
+    organization_id,
     trust_center_access_id,
     document_id,
     report_id,
@@ -1068,6 +1077,10 @@ LIMIT 1;
 
 	access, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[TrustCenterDocumentAccess])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
 		return fmt.Errorf("cannot collect trust center document access: %w", err)
 	}
 
diff --git a/pkg/server/api/trust/v1/v1_resolver.go b/pkg/server/api/trust/v1/v1_resolver.go
index b82b9420f..6a0beeadf 100644
--- a/pkg/server/api/trust/v1/v1_resolver.go
+++ b/pkg/server/api/trust/v1/v1_resolver.go
@@ -95,10 +95,18 @@ func (r *documentResolver) IsUserAuthorized(ctx context.Context, obj *types.Docu
 		obj.ID,
 	)
 	if err != nil {
-		// FIXME check for not found and return without error in this case
-		// r.logger.ErrorCtx(ctx, "cannot check document access", log.Error(err))
-		// return false, gqlutils.Internal(ctx)
-		return false, nil
+		if errors.Is(err, trust.ErrMembershipNotFound) {
+			return false, nil
+		}
+		if errors.Is(err, trust.ErrMembershipInactive) {
+			return false, nil
+		}
+		if errors.Is(err, trust.ErrDocumentAccessNotFound) {
+			return false, nil
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot check document access", log.Error(err))
+		return false, gqlutils.Internal(ctx)
 	}
 
 	return documentAccess.Status == coredata.TrustCenterDocumentAccessStatusGranted, nil
@@ -820,10 +828,18 @@ func (r *reportResolver) IsUserAuthorized(ctx context.Context, obj *types.Report
 		obj.ID,
 	)
 	if err != nil {
-		// FIXME check for not found and return without error in this case
-		// r.logger.ErrorCtx(ctx, "cannot check report access", log.Error(err))
-		// return false, gqlutils.Internal(ctx)
-		return false, nil
+		if errors.Is(err, trust.ErrMembershipNotFound) {
+			return false, nil
+		}
+		if errors.Is(err, trust.ErrMembershipInactive) {
+			return false, nil
+		}
+		if errors.Is(err, trust.ErrDocumentAccessNotFound) {
+			return false, nil
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot check report access", log.Error(err))
+		return false, gqlutils.Internal(ctx)
 	}
 
 	return reportAccess.Status == coredata.TrustCenterDocumentAccessStatusGranted, nil
@@ -1028,10 +1044,18 @@ func (r *trustCenterFileResolver) IsUserAuthorized(ctx context.Context, obj *typ
 		obj.ID,
 	)
 	if err != nil {
-		// FIXME check for not found and return without error in this case
-		// r.logger.ErrorCtx(ctx, "cannot check trust center file access", log.Error(err))
-		// return false, gqlutils.Internal(ctx)
-		return false, nil
+		if errors.Is(err, trust.ErrMembershipNotFound) {
+			return false, nil
+		}
+		if errors.Is(err, trust.ErrMembershipInactive) {
+			return false, nil
+		}
+		if errors.Is(err, trust.ErrDocumentAccessNotFound) {
+			return false, nil
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot check trust center file access", log.Error(err))
+		return false, gqlutils.Internal(ctx)
 	}
 
 	return fileAccess.Status == coredata.TrustCenterDocumentAccessStatusGranted, nil
diff --git a/pkg/trust/errors.go b/pkg/trust/errors.go
index b88a0b135..3a73989e5 100644
--- a/pkg/trust/errors.go
+++ b/pkg/trust/errors.go
@@ -17,7 +17,9 @@ package trust
 import "errors"
 
 var (
-	ErrCustomDomainNotFound = errors.New("custom domain not found")
-	ErrPageNotFound         = errors.New("page not found")
-	ErrMembershipNotFound   = errors.New("membership not found")
+	ErrCustomDomainNotFound   = errors.New("custom domain not found")
+	ErrPageNotFound           = errors.New("page not found")
+	ErrMembershipNotFound     = errors.New("membership not found")
+	ErrMembershipInactive     = errors.New("membership inactive")
+	ErrDocumentAccessNotFound = errors.New("document access not found")
 )
diff --git a/pkg/trust/trust_center_access_service.go b/pkg/trust/trust_center_access_service.go
index 8092cc2a1..dc7bee22d 100644
--- a/pkg/trust/trust_center_access_service.go
+++ b/pkg/trust/trust_center_access_service.go
@@ -295,16 +295,24 @@ func (s TrustCenterAccessService) LoadDocumentAccess(
 		access := &coredata.TrustCenterAccess{}
 		err := access.LoadByTrustCenterIDAndEmail(ctx, conn, s.svc.scope, trustCenterID, email)
 		if err != nil {
+			if errors.Is(err, coredata.ErrResourceNotFound) {
+				return ErrMembershipNotFound
+			}
+
 			return fmt.Errorf("cannot load trust center access: %w", err)
 		}
 
 		if !access.Active {
-			return fmt.Errorf("trust center access is not active")
+			return ErrMembershipInactive
 		}
 
 		documentAccess = &coredata.TrustCenterDocumentAccess{}
 		err = documentAccess.LoadByTrustCenterAccessIDAndDocumentID(ctx, conn, s.svc.scope, access.ID, documentID)
 		if err != nil {
+			if errors.Is(err, coredata.ErrResourceNotFound) {
+				return ErrDocumentAccessNotFound
+			}
+
 			return fmt.Errorf("cannot load document access: %w", err)
 		}
 
@@ -330,16 +338,24 @@ func (s TrustCenterAccessService) LoadReportAccess(
 		access := &coredata.TrustCenterAccess{}
 		err := access.LoadByTrustCenterIDAndEmail(ctx, conn, s.svc.scope, trustCenterID, email)
 		if err != nil {
+			if errors.Is(err, coredata.ErrResourceNotFound) {
+				return ErrMembershipNotFound
+			}
+
 			return fmt.Errorf("cannot load trust center access: %w", err)
 		}
 
 		if !access.Active {
-			return fmt.Errorf("trust center access is not active")
+			return ErrMembershipInactive
 		}
 
 		reportAccess = &coredata.TrustCenterDocumentAccess{}
 		err = reportAccess.LoadByTrustCenterAccessIDAndReportID(ctx, conn, s.svc.scope, access.ID, reportID)
 		if err != nil {
+			if errors.Is(err, coredata.ErrResourceNotFound) {
+				return ErrDocumentAccessNotFound
+			}
+
 			return fmt.Errorf("cannot load report access: %w", err)
 		}
 
@@ -365,16 +381,24 @@ func (s TrustCenterAccessService) LoadTrustCenterFileAccess(
 		access := &coredata.TrustCenterAccess{}
 		err := access.LoadByTrustCenterIDAndEmail(ctx, conn, s.svc.scope, trustCenterID, email)
 		if err != nil {
+			if errors.Is(err, coredata.ErrResourceNotFound) {
+				return ErrMembershipNotFound
+			}
+
 			return fmt.Errorf("cannot load trust center access: %w", err)
 		}
 
 		if !access.Active {
-			return fmt.Errorf("trust center access is not active")
+			return ErrMembershipInactive
 		}
 
 		fileAccess = &coredata.TrustCenterDocumentAccess{}
 		err = fileAccess.LoadByTrustCenterAccessIDAndTrustCenterFileID(ctx, conn, s.svc.scope, access.ID, trustCenterFileID)
 		if err != nil {
+			if errors.Is(err, coredata.ErrResourceNotFound) {
+				return ErrDocumentAccessNotFound
+			}
+
 			return fmt.Errorf("cannot load trust center file access: %w", err)
 		}