From 9a33f7b771ce8c8758d09b734753127b82812abe Mon Sep 17 00:00:00 2001
From: Sacha Al Himdani <sacha@getprobo.com>
Date: Wed, 29 Oct 2025 14:03:50 +0100
Subject: [PATCH] Manage errors

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
---
 apps/console/src/components/PageError.tsx     |  14 +
 .../src/components/tasks/TaskFormDialog.tsx   |  41 +-
 .../src/hooks/forms/useDocumentForm.tsx       |   6 +-
 apps/console/src/hooks/forms/useRiskForm.tsx  |   8 +-
 .../console/src/hooks/forms/useVendorForm.tsx |  26 +-
 apps/console/src/hooks/graph/DocumentGraph.ts |  10 +-
 apps/console/src/hooks/graph/MeasureGraph.ts  |   4 +-
 .../src/hooks/graph/OrganizationGraph.ts      |   2 +-
 apps/console/src/hooks/graph/PeopleGraph.ts   |  11 +-
 apps/console/src/hooks/graph/RiskGraph.ts     |   2 +-
 .../src/hooks/graph/SAMLConfigurationGraph.ts |   2 +-
 .../src/hooks/graph/TrustCenterAuditGraph.ts  |   2 +-
 .../hooks/graph/TrustCenterDocumentGraph.ts   |   2 +-
 .../src/hooks/graph/TrustCenterVendorGraph.ts |   2 +-
 apps/console/src/hooks/graph/VendorGraph.ts   |   2 +-
 .../src/hooks/useMutationWithIncrement.ts     |  26 +-
 .../src/hooks/useMutationWithToasts.ts        |  10 +-
 .../src/pages/auth/ConfirmEmailPage.tsx       |   4 +-
 .../organizations/NewOrganizationPage.tsx     |   6 +-
 .../organizations/audits/AuditDetailsPage.tsx |   4 +-
 .../audits/dialogs/CreateAuditDialog.tsx      |   4 +-
 .../ContinualImprovementDetailsPage.tsx       |   3 +-
 .../CreateContinualImprovementDialog.tsx      |   3 +-
 .../documents/DocumentDetailPage.tsx          |  24 +-
 .../dialogs/CreateDocumentDialog.tsx          |   2 +-
 .../documents/dialogs/UpdateVersionDialog.tsx |   2 +-
 .../documents/tabs/DocumentControlsTab.tsx    |   2 +
 .../frameworks/FrameworkControlPage.tsx       |  67 +-
 .../dialogs/FrameworkControlDialog.tsx        |   4 +-
 .../organizations/measures/MeasuresPage.tsx   |   2 +-
 .../measures/dialog/MeasureFormDialog.tsx     |  33 +-
 .../NonconformityDetailsPage.tsx              |   4 +-
 .../dialogs/CreateNonconformityDialog.tsx     |   3 +-
 .../obligations/ObligationDetailsPage.tsx     |   5 +-
 .../dialogs/CreateObligationDialog.tsx        |   5 +-
 .../people/dialogs/CreatePeopleDialog.tsx     |   2 +-
 .../people/tabs/PeopleProfileTab.tsx          |   2 +-
 .../people/tabs/PeopleRoleTab.tsx             |   2 +-
 .../ProcessingActivityDetailsPage.tsx         |   3 +-
 .../CreateProcessingActivityDialog.tsx        |   3 +-
 .../organizations/risks/FormRiskDialog.tsx    |   4 +-
 .../snapshots/dialog/SnapshotFormDialog.tsx   |   2 +-
 .../trustCenter/TrustCenterAccessTab.tsx      |   6 +-
 .../vendors/dialogs/CreateContactDialog.tsx   |   6 +-
 .../dialogs/CreateRiskAssessmentDialog.tsx    |   2 +-
 .../vendors/dialogs/CreateServiceDialog.tsx   |   2 +-
 .../vendors/dialogs/EditContactDialog.tsx     |   6 +-
 .../vendors/dialogs/EditServiceDialog.tsx     |   2 +-
 .../dialogs/ImportAssessmentDialog.tsx        |   2 +-
 apps/console/src/providers/RelayProviders.tsx |  22 +-
 apps/console/src/routes.tsx                   |   5 +
 packages/helpers/src/error.ts                 |  26 +
 packages/helpers/src/index.ts                 |   1 +
 .../ui/src/Layouts/ErrorLayout.stories.tsx    |   2 +-
 .../ui/src/Molecules/Dialog/ConfirmDialog.tsx |   4 +-
 pkg/authz/service.go                          |   8 +
 pkg/coredata/asset.go                         |  25 +
 pkg/coredata/audit.go                         |  25 +
 pkg/coredata/control.go                       |  53 +-
 pkg/coredata/custom_domain.go                 |  26 +
 pkg/coredata/document.go                      |  21 +
 pkg/coredata/document_version.go              |  41 ++
 pkg/coredata/document_version_signature.go    |  26 +
 pkg/coredata/evidence.go                      |  33 +-
 pkg/coredata/file.go                          |  37 +-
 pkg/coredata/framework.go                     |  26 +-
 pkg/coredata/measure.go                       |  37 +-
 pkg/coredata/organization.go                  |  25 +
 pkg/coredata/people.go                        |  12 +
 pkg/coredata/risk.go                          |  21 +
 pkg/coredata/session.go                       |  37 +-
 pkg/coredata/task.go                          |  37 +-
 pkg/coredata/trust_center.go                  |  26 +
 pkg/coredata/trust_center_access.go           |  17 +
 pkg/coredata/trust_center_document_access.go  |  28 +
 pkg/coredata/trust_center_reference.go        |  24 +-
 pkg/coredata/vendor.go                        |  21 +
 .../vendor_business_associate_agreement.go    |  31 +-
 pkg/coredata/vendor_data_privacy_agreement.go |  31 +-
 pkg/probo/document_service.go                 |   4 +-
 pkg/server/api/console/v1/resolver.go         |   4 +-
 pkg/server/api/console/v1/v1_resolver.go      | 582 ++++++++++++++----
 pkg/server/graphql/errors.go                  |  69 +++
 pkg/server/graphql/recovery.go                |  36 +-
 84 files changed, 1483 insertions(+), 331 deletions(-)
 create mode 100644 packages/helpers/src/error.ts
 create mode 100644 pkg/server/graphql/errors.go

diff --git a/apps/console/src/components/PageError.tsx b/apps/console/src/components/PageError.tsx
index a315db75d..a27b8d42a 100644
--- a/apps/console/src/components/PageError.tsx
+++ b/apps/console/src/components/PageError.tsx
@@ -68,6 +68,20 @@ export function PageError({ resetErrorBoundary, error: propsError }: Props) {
     );
   }
 
+  if (error && error.toString().includes("UNAUTHORIZED")) {
+    return (
+      <div className={classNames.wrapper}>
+        <h1 className={classNames.title}>
+          <IconPageCross size={26} />
+          {__("Access denied")}
+        </h1>
+        <p className={classNames.description}>
+          {__("You don't have permission to access this organization")}
+        </p>
+      </div>
+    );
+  }
+
   return (
     <div className={classNames.wrapper}>
       <h1 className={classNames.title}>{__("Unexpected error :(")}</h1>
diff --git a/apps/console/src/components/tasks/TaskFormDialog.tsx b/apps/console/src/components/tasks/TaskFormDialog.tsx
index 14100f845..117eb2a01 100644
--- a/apps/console/src/components/tasks/TaskFormDialog.tsx
+++ b/apps/console/src/components/tasks/TaskFormDialog.tsx
@@ -69,13 +69,28 @@ export const taskUpdateMutation = graphql`
   }
 `;
 
-const schema = z.object({
-  name: z.string(),
+const createTaskSchema = z.object({
+  name: z.string().min(1),
   description: z.string(),
-  timeEstimate: z.string().nullable(),
-  assignedToId: z.string(),
-  measureId: z.string(),
-  deadline: z.string().optional(),
+  timeEstimate: z.string().optional().nullable(),
+  assignedToId: z.preprocess(
+    (val) => (val === "" || val == null ? undefined : val),
+    z.string({ required_error: "Assigned to is required" }).min(1, "Assigned to is required")
+  ),
+  measureId: z.preprocess(
+    (val) => (val === "" || val == null ? undefined : val),
+    z.string({ required_error: "Measure is required" }).min(1, "Measure is required")
+  ),
+  deadline: z.string().optional().nullable(),
+});
+
+const updateTaskSchema = z.object({
+  name: z.string().min(1),
+  description: z.string(),
+  timeEstimate: z.string().optional().nullable(),
+  assignedToId: z.string().optional(),
+  measureId: z.string().optional(),
+  deadline: z.string().optional().nullable(),
 });
 
 type Props = {
@@ -95,15 +110,17 @@ export default function TaskFormDialog(props: Props) {
   const [mutate] = task
     ? useMutationWithToasts(taskUpdateMutation, {
         successMessage: __("Task updated successfully."),
-        errorMessage: __("Failed to update task. Please try again."),
+        errorMessage: __("Failed to update task"),
       })
     : useMutationWithToasts(taskCreateMutation, {
         successMessage: __("Task created successfully."),
-        errorMessage: __("Failed to create task. Please try again."),
+        errorMessage: __("Failed to create task"),
       });
 
+  const isUpdating = !!task;
+
   const { control, handleSubmit, register, formState, reset } =
-    useFormWithSchema(schema, {
+    useFormWithSchema(isUpdating ? updateTaskSchema : createTaskSchema, {
       defaultValues: {
         name: task?.name ?? "",
         description: task?.description ?? "",
@@ -142,7 +159,7 @@ export default function TaskFormDialog(props: Props) {
           connections: [props.connection!],
         },
         onCompleted: (_response, errors) => {
-          if (!errors) {
+          if (!errors && data.measureId) {
             updateStoreCounter(relayEnv, data.measureId, "tasks(first:0)", 1);
           }
         },
@@ -151,7 +168,6 @@ export default function TaskFormDialog(props: Props) {
     }
     dialogRef.current?.close();
   });
-  const isUpdating = !!task;
   const showMeasure = !props.measureId && !isUpdating;
   const isCreating = !isUpdating;
 
@@ -217,9 +233,10 @@ export default function TaskFormDialog(props: Props) {
               <Controller
                 name="timeEstimate"
                 control={control}
-                render={({ field: { onChange, ...field } }) => (
+                render={({ field: { onChange, value, ...field } }) => (
                   <DurationPicker
                     {...field}
+                    value={value ?? null}
                     onValueChange={(value) => onChange(value)}
                   />
                 )}
diff --git a/apps/console/src/hooks/forms/useDocumentForm.tsx b/apps/console/src/hooks/forms/useDocumentForm.tsx
index 82e7ab2e6..9ab6bf427 100644
--- a/apps/console/src/hooks/forms/useDocumentForm.tsx
+++ b/apps/console/src/hooks/forms/useDocumentForm.tsx
@@ -2,9 +2,9 @@ import { z } from "zod";
 import { useFormWithSchema } from "../useFormWithSchema";
 
 export const documentSchema = z.object({
-  title: z.string(),
-  content: z.string(),
-  ownerId: z.string(),
+  title: z.string().min(1, "Title is required"),
+  content: z.string().min(1, "Content is required"),
+  ownerId: z.string().min(1, "Owner is required"),
   documentType: z.enum(["OTHER", "ISMS", "POLICY", "PROCEDURE"]),
   classification: z.enum(["PUBLIC", "INTERNAL", "CONFIDENTIAL", "SECRET"]),
 });
diff --git a/apps/console/src/hooks/forms/useRiskForm.tsx b/apps/console/src/hooks/forms/useRiskForm.tsx
index 50791095e..262e0d4f1 100644
--- a/apps/console/src/hooks/forms/useRiskForm.tsx
+++ b/apps/console/src/hooks/forms/useRiskForm.tsx
@@ -32,10 +32,10 @@ export type RiskKey = useRiskFormFragment$key & { id: string };
 
 // Export the schema so it can be used elsewhere
 export const riskSchema = z.object({
-  category: z.string(),
-  name: z.string(),
-  description: z.string(),
-  ownerId: z.string(),
+  category: z.string().min(1, "Category is required"),
+  name: z.string().min(1, "Name is required"),
+  description: z.string().min(1, "Description is required"),
+  ownerId: z.string().min(1, "Owner is required"),
   treatment: z.enum(["AVOIDED", "MITIGATED", "TRANSFERRED", "ACCEPTED"]),
   inherentLikelihood: z.number({ coerce: true }).min(1).max(5),
   inherentImpact: z.number({ coerce: true }).min(1).max(5),
diff --git a/apps/console/src/hooks/forms/useVendorForm.tsx b/apps/console/src/hooks/forms/useVendorForm.tsx
index 1c11fa516..16b2aeba2 100644
--- a/apps/console/src/hooks/forms/useVendorForm.tsx
+++ b/apps/console/src/hooks/forms/useVendorForm.tsx
@@ -8,21 +8,21 @@ import { useTranslate } from "@probo/i18n";
 import { useEffect, useMemo } from "react";
 
 const schema = z.object({
-  name: z.string(),
-  description: z.string(),
+  name: z.string().min(1, "Name is required"),
+  description: z.string().min(1, "Description is required"),
   category: z.string().nullish(),
-  statusPageUrl: z.string(),
-  termsOfServiceUrl: z.string(),
-  privacyPolicyUrl: z.string(),
-  serviceLevelAgreementUrl: z.string(),
-  dataProcessingAgreementUrl: z.string(),
-  websiteUrl: z.string(),
-  legalName: z.string(),
-  headquarterAddress: z.string(),
+  statusPageUrl: z.string().optional(),
+  termsOfServiceUrl: z.string().optional(),
+  privacyPolicyUrl: z.string().optional(),
+  serviceLevelAgreementUrl: z.string().optional(),
+  dataProcessingAgreementUrl: z.string().optional(),
+  websiteUrl: z.string().optional(),
+  legalName: z.string().optional(),
+  headquarterAddress: z.string().optional(),
   certifications: z.array(z.string()),
   countries: z.array(z.string()),
-  securityPageUrl: z.string(),
-  trustPageUrl: z.string(),
+  securityPageUrl: z.string().optional(),
+  trustPageUrl: z.string().optional(),
   businessOwnerId: z.string().nullish(),
   securityOwnerId: z.string().nullish(),
 });
@@ -70,7 +70,7 @@ export function useVendorForm(vendorKey: useVendorFormFragment$key) {
 
   const [mutate] = useMutationWithToasts(vendorUpdateQuery, {
     successMessage: __("Vendor updated successfully."),
-    errorMessage: __("Failed to update vendor. Please try again."),
+    errorMessage: __("Failed to update vendor"),
   });
 
   const defaultValues = useMemo(
diff --git a/apps/console/src/hooks/graph/DocumentGraph.ts b/apps/console/src/hooks/graph/DocumentGraph.ts
index 19953adcb..49b180cf8 100644
--- a/apps/console/src/hooks/graph/DocumentGraph.ts
+++ b/apps/console/src/hooks/graph/DocumentGraph.ts
@@ -34,7 +34,7 @@ export function useDeleteDocumentMutation() {
     deleteDocumentMutation,
     {
       successMessage: __("Document deleted successfully."),
-      errorMessage: __("Failed to delete document. Please try again."),
+      errorMessage: __("Failed to delete document"),
     }
   );
 }
@@ -57,7 +57,7 @@ export function useDeleteDraftDocumentVersionMutation() {
     deleteDraftDocumentVersionMutation,
     {
       successMessage: __("Draft deleted successfully."),
-      errorMessage: __("Failed to delete draft. Please try again."),
+      errorMessage: __("Failed to delete draft"),
     }
   );
 }
@@ -79,7 +79,7 @@ export function useBulkDeleteDocumentsMutation() {
     bulkDeleteDocumentsMutation,
     {
       successMessage: __("Documents deleted successfully."),
-      errorMessage: __("Failed to delete documents. Please try again."),
+      errorMessage: __("Failed to delete documents"),
     }
   );
 }
@@ -101,7 +101,7 @@ export function useSendSigningNotificationsMutation() {
     sendSigningNotificationsMutation,
     {
       successMessage: __("Signing notifications sent successfully."),
-      errorMessage: __("Failed to send signing notifications. Please try again."),
+      errorMessage: __("Failed to send signing notifications"),
     }
   );
 }
@@ -123,7 +123,7 @@ export function useBulkExportDocumentsMutation() {
     bulkExportDocumentsMutation,
     {
       successMessage: __("Document export started successfully. You will receive an email when the export is ready."),
-      errorMessage: __("Failed to start document export. Please try again."),
+      errorMessage: __("Failed to start document export"),
     }
   );
 }
diff --git a/apps/console/src/hooks/graph/MeasureGraph.ts b/apps/console/src/hooks/graph/MeasureGraph.ts
index 235d64985..cf4277b27 100644
--- a/apps/console/src/hooks/graph/MeasureGraph.ts
+++ b/apps/console/src/hooks/graph/MeasureGraph.ts
@@ -32,7 +32,7 @@ export function useDeleteMeasureMutation() {
     deleteMeasureMutation,
     {
       successMessage: __("Measure deleted successfully."),
-      errorMessage: __("Failed to delete measure. Please try again."),
+      errorMessage: __("Failed to delete measure"),
     }
   );
 }
@@ -83,6 +83,6 @@ export const useUpdateMeasure = () => {
 
   return useMutationWithToasts(measureUpdateMutation, {
     successMessage: __("Measure updated successfully."),
-    errorMessage: __("Failed to update measure. Please try again."),
+    errorMessage: __("Failed to update measure"),
   });
 };
diff --git a/apps/console/src/hooks/graph/OrganizationGraph.ts b/apps/console/src/hooks/graph/OrganizationGraph.ts
index 2d4330cb5..8df814d97 100644
--- a/apps/console/src/hooks/graph/OrganizationGraph.ts
+++ b/apps/console/src/hooks/graph/OrganizationGraph.ts
@@ -33,7 +33,7 @@ export function useDeleteOrganizationMutation() {
     deleteOrganizationMutation,
     {
       successMessage: __("Organization deleted successfully."),
-      errorMessage: __("Failed to delete organization. Please try again."),
+      errorMessage: __("Failed to delete organization"),
     }
   );
 }
diff --git a/apps/console/src/hooks/graph/PeopleGraph.ts b/apps/console/src/hooks/graph/PeopleGraph.ts
index ba2e571ff..dec15875f 100644
--- a/apps/console/src/hooks/graph/PeopleGraph.ts
+++ b/apps/console/src/hooks/graph/PeopleGraph.ts
@@ -10,9 +10,9 @@ import {
 import { useMemo } from "react";
 import type { PeopleGraphPaginatedQuery } from "./__generated__/PeopleGraphPaginatedQuery.graphql";
 import type { PeopleGraphPaginatedFragment$key } from "./__generated__/PeopleGraphPaginatedFragment.graphql";
-import { useConfirm } from "@probo/ui";
+import { useConfirm, useToast } from "@probo/ui";
 import type { PeopleGraphDeleteMutation } from "./__generated__/PeopleGraphDeleteMutation.graphql";
-import { promisifyMutation, sprintf } from "@probo/helpers";
+import { promisifyMutation, sprintf, formatError, type GraphQLError } from "@probo/helpers";
 import { useTranslate } from "@probo/i18n";
 
 const peopleQuery = graphql`
@@ -132,6 +132,7 @@ export const useDeletePeople = (
 ) => {
   const [mutate] = useMutation<PeopleGraphDeleteMutation>(deletePeopleMutation);
   const confirm = useConfirm();
+  const { toast } = useToast();
   const { __ } = useTranslate();
 
   return () => {
@@ -147,6 +148,12 @@ export const useDeletePeople = (
             },
             connections: [connectionId],
           },
+        }).catch((error) => {
+          toast({
+            title: __("Error"),
+            description: formatError(__("Failed to delete people"), error as GraphQLError),
+            variant: "error",
+          });
         }),
       {
         message: sprintf(
diff --git a/apps/console/src/hooks/graph/RiskGraph.ts b/apps/console/src/hooks/graph/RiskGraph.ts
index 17ad0f038..8dc288c25 100644
--- a/apps/console/src/hooks/graph/RiskGraph.ts
+++ b/apps/console/src/hooks/graph/RiskGraph.ts
@@ -26,7 +26,7 @@ export function useDeleteRiskMutation() {
 
   return useMutationWithToasts<RiskGraphDeleteMutation>(deleteRiskMutation, {
     successMessage: __("Risk deleted successfully."),
-    errorMessage: __("Failed to delete risk. Please try again."),
+    errorMessage: __("Failed to delete risk"),
   });
 }
 
diff --git a/apps/console/src/hooks/graph/SAMLConfigurationGraph.ts b/apps/console/src/hooks/graph/SAMLConfigurationGraph.ts
index 5df137a64..841ab9ee2 100644
--- a/apps/console/src/hooks/graph/SAMLConfigurationGraph.ts
+++ b/apps/console/src/hooks/graph/SAMLConfigurationGraph.ts
@@ -137,7 +137,7 @@ export function useCreateSAMLConfigurationMutation() {
     createSAMLConfigurationMutation,
     {
       successMessage: "SAML configuration created successfully.",
-      errorMessage: "Failed to create SAML configuration. Please try again.",
+      errorMessage: "Failed to create SAML configuration",
     }
   );
 }
diff --git a/apps/console/src/hooks/graph/TrustCenterAuditGraph.ts b/apps/console/src/hooks/graph/TrustCenterAuditGraph.ts
index 6d8d4cf5b..324f711d6 100644
--- a/apps/console/src/hooks/graph/TrustCenterAuditGraph.ts
+++ b/apps/console/src/hooks/graph/TrustCenterAuditGraph.ts
@@ -22,7 +22,7 @@ export function useTrustCenterAuditUpdate() {
     trustCenterAuditUpdateMutation,
     {
       successMessage: __("Audit visibility updated successfully."),
-      errorMessage: __("Failed to update audit visibility. Please try again."),
+      errorMessage: __("Failed to update audit visibility"),
     }
   );
 }
diff --git a/apps/console/src/hooks/graph/TrustCenterDocumentGraph.ts b/apps/console/src/hooks/graph/TrustCenterDocumentGraph.ts
index 2780650b9..5bead06e9 100644
--- a/apps/console/src/hooks/graph/TrustCenterDocumentGraph.ts
+++ b/apps/console/src/hooks/graph/TrustCenterDocumentGraph.ts
@@ -40,7 +40,7 @@ export function useUpdateDocumentVisibilityMutation() {
     updateDocumentVisibilityMutation,
     {
       successMessage: __("Document visibility updated successfully."),
-      errorMessage: __("Failed to update document visibility. Please try again."),
+      errorMessage: __("Failed to update document visibility"),
     }
   );
 }
diff --git a/apps/console/src/hooks/graph/TrustCenterVendorGraph.ts b/apps/console/src/hooks/graph/TrustCenterVendorGraph.ts
index 85a38402d..b94e94308 100644
--- a/apps/console/src/hooks/graph/TrustCenterVendorGraph.ts
+++ b/apps/console/src/hooks/graph/TrustCenterVendorGraph.ts
@@ -22,7 +22,7 @@ export function useTrustCenterVendorUpdate() {
     trustCenterVendorUpdateMutation,
     {
       successMessage: __("Vendor visibility updated successfully."),
-      errorMessage: __("Failed to update vendor visibility. Please try again."),
+      errorMessage: __("Failed to update vendor visibility"),
     }
   );
 }
diff --git a/apps/console/src/hooks/graph/VendorGraph.ts b/apps/console/src/hooks/graph/VendorGraph.ts
index 31e879039..6139e5bd4 100644
--- a/apps/console/src/hooks/graph/VendorGraph.ts
+++ b/apps/console/src/hooks/graph/VendorGraph.ts
@@ -36,7 +36,7 @@ export function useCreateVendorMutation() {
     createVendorMutation,
     {
       successMessage: __("Vendor created successfully."),
-      errorMessage: __("Failed to create vendor. Please try again."),
+      errorMessage: __("Failed to create vendor"),
     }
   );
 }
diff --git a/apps/console/src/hooks/useMutationWithIncrement.ts b/apps/console/src/hooks/useMutationWithIncrement.ts
index b6fab88c7..8af8b6c86 100644
--- a/apps/console/src/hooks/useMutationWithIncrement.ts
+++ b/apps/console/src/hooks/useMutationWithIncrement.ts
@@ -10,6 +10,9 @@ import {
   type GraphQLTaggedNode,
   type MutationParameters,
 } from "relay-runtime";
+import { useToast } from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import { formatError, type GraphQLError } from "@probo/helpers";
 
 const defaultOptions = {
   field: "totalCount",
@@ -26,17 +29,27 @@ export function useMutationWithIncrement<T extends MutationParameters>(
     node: string;
     field?: string;
     value?: 1 | -1;
+    errorMessage?: string;
   },
 ) {
   const [mutate, isLoading] = useMutation<T>(query);
   const relayEnv = useRelayEnvironment();
+  const { toast } = useToast();
+  const { __ } = useTranslate();
   const options = { ...defaultOptions, ...baseOptions };
   const mutateAndIncrement = useCallback(
     (queryOptions: UseMutationConfig<T>) => {
       return mutate({
         ...queryOptions,
         onCompleted: (response, error) => {
-          if (!error) {
+          if (error) {
+            const errorTitle = options.errorMessage ?? __("Failed to commit this operation");
+            toast({
+              title: __("Error"),
+              description: formatError(errorTitle, error as GraphQLError[]),
+              variant: "error",
+            });
+          } else {
             updateStoreCounter(
               relayEnv,
               options.id,
@@ -47,9 +60,18 @@ export function useMutationWithIncrement<T extends MutationParameters>(
           }
           queryOptions.onCompleted?.(response, error);
         },
+        onError: (error) => {
+          const errorTitle = options.errorMessage ?? __("Failed to commit this operation");
+          toast({
+            title: __("Error"),
+            description: formatError(errorTitle, error as GraphQLError),
+            variant: "error",
+          });
+          queryOptions.onError?.(error);
+        },
       });
     },
-    [mutate, options.id, options.node, options.field, options.value, relayEnv],
+    [mutate, options.id, options.node, options.field, options.value, options.errorMessage, relayEnv, toast, __],
   );
 
   return [mutateAndIncrement, isLoading] as const;
diff --git a/apps/console/src/hooks/useMutationWithToasts.ts b/apps/console/src/hooks/useMutationWithToasts.ts
index e6e42fbad..3d18b6a36 100644
--- a/apps/console/src/hooks/useMutationWithToasts.ts
+++ b/apps/console/src/hooks/useMutationWithToasts.ts
@@ -3,6 +3,7 @@ import { useMutation, type UseMutationConfig } from "react-relay";
 import { useToast } from "@probo/ui";
 import { useTranslate } from "@probo/i18n";
 import type { MutationParameters, GraphQLTaggedNode } from "relay-runtime";
+import { formatError, type GraphQLError } from "@probo/helpers";
 
 /**
  * A decorated useMutation hook that emits toast notifications on success or error.
@@ -32,11 +33,10 @@ export function useMutationWithToasts<T extends MutationParameters>(
           onCompleted: (response, error) => {
             options.onCompleted?.(response, error);
             if (error) {
+              const errorTitle = options.errorMessage ?? __("Failed to commit this operation");
               toast({
                 title: __("Error"),
-                description:
-                  options.errorMessage ??
-                  __("Failed to commit this operation."),
+                description: formatError(errorTitle, error as GraphQLError[]),
                 variant: "error",
               });
               reject(error);
@@ -57,10 +57,10 @@ export function useMutationWithToasts<T extends MutationParameters>(
             resolve();
           },
           onError: (error) => {
+            const errorTitle = options.errorMessage ?? __("Failed to commit this operation");
             toast({
               title: __("Error"),
-              description:
-                options.errorMessage ?? __("Failed to commit this operation."),
+              description: formatError(errorTitle, error as GraphQLError),
               variant: "error",
             });
             reject(error);
diff --git a/apps/console/src/pages/auth/ConfirmEmailPage.tsx b/apps/console/src/pages/auth/ConfirmEmailPage.tsx
index f788e79a5..c35a11658 100644
--- a/apps/console/src/pages/auth/ConfirmEmailPage.tsx
+++ b/apps/console/src/pages/auth/ConfirmEmailPage.tsx
@@ -81,7 +81,7 @@ export default function ConfirmEmailPage() {
         onError: (err) => {
           toast({
             title: __("Error"),
-            description: err.message || __("Failed to confirm email. Please try again."),
+            description: err.message || __("Failed to confirm email"),
             variant: "error",
           });
           setIsLoading(false);
@@ -90,7 +90,7 @@ export default function ConfirmEmailPage() {
     } catch (error) {
       toast({
         title: __("Error"),
-        description: error instanceof Error ? error.message : __("Failed to confirm email. Please try again."),
+        description: error instanceof Error ? error.message : __("Failed to confirm email"),
         variant: "error",
       });
       setIsLoading(false);
diff --git a/apps/console/src/pages/organizations/NewOrganizationPage.tsx b/apps/console/src/pages/organizations/NewOrganizationPage.tsx
index 80adeb9ac..868dc24d9 100644
--- a/apps/console/src/pages/organizations/NewOrganizationPage.tsx
+++ b/apps/console/src/pages/organizations/NewOrganizationPage.tsx
@@ -6,6 +6,7 @@ import type { NewOrganizationPageQuery as NewOrganizationPageQueryType } from ".
 import type { NewOrganizationPageMutation as NewOrganizationPageMutationType } from "./__generated__/NewOrganizationPageMutation.graphql";
 import { useState, type FormEventHandler } from "react";
 import { useNavigate } from "react-router";
+import { formatError, type GraphQLError } from "@probo/helpers";
 
 const createOrganizationMutation = graphql`
   mutation NewOrganizationPageMutation(
@@ -75,11 +76,12 @@ export default function NewOrganizationPage() {
           variant: "success",
         });
       },
-      onError: (e) => {
+      onError: (e: GraphQLError) => {
         setIsFetching(false);
+
         toast({
           title: __("Error"),
-          description: e.message ?? __("Failed to create organization"),
+          description: formatError(__("Failed to create organization"), e),
           variant: "error",
         });
       },
diff --git a/apps/console/src/pages/organizations/audits/AuditDetailsPage.tsx b/apps/console/src/pages/organizations/audits/AuditDetailsPage.tsx
index 8da206fe4..dd8180905 100644
--- a/apps/console/src/pages/organizations/audits/AuditDetailsPage.tsx
+++ b/apps/console/src/pages/organizations/audits/AuditDetailsPage.tsx
@@ -32,7 +32,7 @@ import { FrameworkLogo } from "/components/FrameworkLogo";
 import { ControlledField } from "/components/form/ControlledField";
 import { useFormWithSchema } from "/hooks/useFormWithSchema";
 import z from "zod";
-import { getAuditStateLabel, getAuditStateVariant, auditStates, fileSize, sprintf, formatDatetime, formatDate } from "@probo/helpers";
+import { getAuditStateLabel, getAuditStateVariant, auditStates, fileSize, sprintf, formatDatetime, formatError, formatDate, type GraphQLError } from "@probo/helpers";
 import type { AuditGraphNodeQuery } from "/hooks/graph/__generated__/AuditGraphNodeQuery.graphql";
 
 const updateAuditSchema = z.object({
@@ -96,7 +96,7 @@ export default function AuditDetailsPage(props: Props) {
     } catch (error) {
       toast({
         title: __("Error"),
-        description: error instanceof Error ? error.message : __("Failed to update audit"),
+        description: formatError(__("Failed to update audit"), error as GraphQLError),
         variant: "error",
       });
     }
diff --git a/apps/console/src/pages/organizations/audits/dialogs/CreateAuditDialog.tsx b/apps/console/src/pages/organizations/audits/dialogs/CreateAuditDialog.tsx
index 9f7fc8353..81ba3fa6e 100644
--- a/apps/console/src/pages/organizations/audits/dialogs/CreateAuditDialog.tsx
+++ b/apps/console/src/pages/organizations/audits/dialogs/CreateAuditDialog.tsx
@@ -16,7 +16,7 @@ import z from "zod";
 import { useFormWithSchema } from "/hooks/useFormWithSchema";
 import { ControlledField } from "/components/form/ControlledField";
 import { useCreateAudit } from "/hooks/graph/AuditGraph";
-import { auditStates, getAuditStateLabel, formatDatetime } from "@probo/helpers";
+import { auditStates, getAuditStateLabel, formatDatetime, formatError, type GraphQLError } from "@probo/helpers";
 import { useLazyLoadQuery } from "react-relay";
 import { graphql } from "relay-runtime";
 import { Suspense } from "react";
@@ -94,7 +94,7 @@ export function CreateAuditDialog({
     } catch (error) {
       toast({
         title: __("Error"),
-        description: error instanceof Error ? error.message : __("Failed to create audit"),
+        description: formatError(__("Failed to create audit"), error as GraphQLError),
         variant: "error",
       });
     }
diff --git a/apps/console/src/pages/organizations/continualImprovements/ContinualImprovementDetailsPage.tsx b/apps/console/src/pages/organizations/continualImprovements/ContinualImprovementDetailsPage.tsx
index b8c1667b1..0a6b95e52 100644
--- a/apps/console/src/pages/organizations/continualImprovements/ContinualImprovementDetailsPage.tsx
+++ b/apps/console/src/pages/organizations/continualImprovements/ContinualImprovementDetailsPage.tsx
@@ -30,6 +30,7 @@ import { useOrganizationId } from "/hooks/useOrganizationId";
 import { PeopleSelectField } from "/components/form/PeopleSelectField";
 import { useFormWithSchema } from "/hooks/useFormWithSchema";
 import { Controller } from "react-hook-form";
+import { formatError, type GraphQLError } from "@probo/helpers";
 import z from "zod";
 import { getStatusVariant, getStatusLabel, formatDatetime, validateSnapshotConsistency } from "@probo/helpers";
 import { SnapshotBanner } from "/components/SnapshotBanner";
@@ -113,7 +114,7 @@ export default function ContinualImprovementDetailsPage(props: Props) {
     } catch (error) {
       toast({
         title: __("Error"),
-        description: __("Failed to update continual improvement entry"),
+        description: formatError(__("Failed to update continual improvement"), error as GraphQLError),
         variant: "error",
       });
     }
diff --git a/apps/console/src/pages/organizations/continualImprovements/dialogs/CreateContinualImprovementDialog.tsx b/apps/console/src/pages/organizations/continualImprovements/dialogs/CreateContinualImprovementDialog.tsx
index a33a2c3cc..a5a6b5af3 100644
--- a/apps/console/src/pages/organizations/continualImprovements/dialogs/CreateContinualImprovementDialog.tsx
+++ b/apps/console/src/pages/organizations/continualImprovements/dialogs/CreateContinualImprovementDialog.tsx
@@ -20,6 +20,7 @@ import { useFormWithSchema } from "/hooks/useFormWithSchema";
 import { useCreateContinualImprovement } from "../../../../hooks/graph/ContinualImprovementGraph";
 import { PeopleSelectField } from "/components/form/PeopleSelectField";
 import { Controller } from "react-hook-form";
+import { formatError, type GraphQLError } from "@probo/helpers";
 import { formatDatetime } from "@probo/helpers";
 
 const schema = z.object({
@@ -87,7 +88,7 @@ export function CreateContinualImprovementDialog({
     } catch (error) {
       toast({
         title: __("Error"),
-        description: __("Failed to create continual improvement entry"),
+        description: formatError(__("Failed to create continual improvement"), error as GraphQLError),
         variant: "error",
       });
     }
diff --git a/apps/console/src/pages/organizations/documents/DocumentDetailPage.tsx b/apps/console/src/pages/organizations/documents/DocumentDetailPage.tsx
index 3e5966367..0b8461536 100644
--- a/apps/console/src/pages/organizations/documents/DocumentDetailPage.tsx
+++ b/apps/console/src/pages/organizations/documents/DocumentDetailPage.tsx
@@ -245,7 +245,7 @@ export default function DocumentDetailPage(props: Props) {
     publishDocumentVersionMutation,
     {
       successMessage: __("Document published successfully."),
-      errorMessage: __("Failed to publish document. Please try again."),
+      errorMessage: __("Failed to publish document"),
     }
   );
   const [deleteDocument, isDeleting] = useDeleteDocumentMutation();
@@ -256,23 +256,19 @@ export default function DocumentDetailPage(props: Props) {
       exportDocumentVersionPDFMutation,
       {
         successMessage: __("PDF download started."),
-        errorMessage: __("Failed to generate PDF. Please try again."),
+        errorMessage: __("Failed to generate PDF"),
       }
     );
 
-  const userEmailData = useLazyLoadQuery<DocumentDetailPageUserEmailQuery>(
-    UserEmailQuery,
-    {}
-  );
+  const userEmailData = useLazyLoadQuery<DocumentDetailPageUserEmailQuery>(UserEmailQuery, {});
   const defaultEmail = userEmailData.viewer.user.email;
-  const [updateDocument, isUpdatingDocument] =
-    useMutationWithToasts<DocumentDetailPageUpdateMutation>(
-      updateDocumentMutation,
-      {
-        successMessage: __("Document updated successfully."),
-        errorMessage: __("Failed to update document. Please try again."),
-      }
-    );
+  const [updateDocument, isUpdatingDocument] = useMutationWithToasts<DocumentDetailPageUpdateMutation>(
+    updateDocumentMutation,
+    {
+      successMessage: __("Document updated successfully."),
+      errorMessage: __("Failed to update document"),
+    }
+  );
   const versionConnectionId = document.versions.__id;
 
   const { register, control, handleSubmit, reset } = useFormWithSchema(
diff --git a/apps/console/src/pages/organizations/documents/dialogs/CreateDocumentDialog.tsx b/apps/console/src/pages/organizations/documents/dialogs/CreateDocumentDialog.tsx
index 460c95acf..6b5c0955d 100644
--- a/apps/console/src/pages/organizations/documents/dialogs/CreateDocumentDialog.tsx
+++ b/apps/console/src/pages/organizations/documents/dialogs/CreateDocumentDialog.tsx
@@ -67,7 +67,7 @@ export function CreateDocumentDialog({ trigger, connection }: Props) {
         connections: [connection!],
       },
       successMessage: __("Document created successfully."),
-      errorMessage: __("Failed to create document. Please try again."),
+      errorMessage: __("Failed to create document"),
       onSuccess: () => {
         dialogRef.current?.close();
         reset();
diff --git a/apps/console/src/pages/organizations/documents/dialogs/UpdateVersionDialog.tsx b/apps/console/src/pages/organizations/documents/dialogs/UpdateVersionDialog.tsx
index 1b208b8c9..8fa5fe2b6 100644
--- a/apps/console/src/pages/organizations/documents/dialogs/UpdateVersionDialog.tsx
+++ b/apps/console/src/pages/organizations/documents/dialogs/UpdateVersionDialog.tsx
@@ -89,7 +89,7 @@ export default function UpdateVersionDialog({
       UpdateDocumentMutation,
       {
         successMessage: __("Document updated successfully."),
-        errorMessage: __("Failed to update document. Please try again."),
+        errorMessage: __("Failed to update document"),
       }
     );
   const { handleSubmit, register } = useFormWithSchema(versionSchema, {
diff --git a/apps/console/src/pages/organizations/documents/tabs/DocumentControlsTab.tsx b/apps/console/src/pages/organizations/documents/tabs/DocumentControlsTab.tsx
index d8e22ff28..007d0fe28 100644
--- a/apps/console/src/pages/organizations/documents/tabs/DocumentControlsTab.tsx
+++ b/apps/console/src/pages/organizations/documents/tabs/DocumentControlsTab.tsx
@@ -78,6 +78,7 @@ export default function DocumentControlsTab() {
     {
       ...incrementOptions,
       value: -1,
+      errorMessage: "Failed to unlink control",
     },
   );
   const [attachControl, isAttaching] = useMutationWithIncrement(
@@ -85,6 +86,7 @@ export default function DocumentControlsTab() {
     {
       ...incrementOptions,
       value: 1,
+      errorMessage: "Failed to link control",
     },
   );
   const isLoading = isDetaching || isAttaching;
diff --git a/apps/console/src/pages/organizations/frameworks/FrameworkControlPage.tsx b/apps/console/src/pages/organizations/frameworks/FrameworkControlPage.tsx
index 94d7badaa..3f919092a 100644
--- a/apps/console/src/pages/organizations/frameworks/FrameworkControlPage.tsx
+++ b/apps/console/src/pages/organizations/frameworks/FrameworkControlPage.tsx
@@ -2,8 +2,9 @@ import {
   useMutation,
   usePreloadedQuery,
   type PreloadedQuery,
+  type UseMutationConfig,
 } from "react-relay";
-import { graphql } from "relay-runtime";
+import { graphql, type MutationParameters } from "relay-runtime";
 import {
   ActionDropdown,
   Button,
@@ -11,8 +12,10 @@ import {
   IconPencil,
   IconTrashCan,
   useConfirm,
+  useToast,
 } from "@probo/ui";
 import { useTranslate } from "@probo/i18n";
+import { formatError, type GraphQLError } from "@probo/helpers";
 import { LinkedMeasuresCard } from "/components/measures/LinkedMeasuresCard";
 import { useNavigate, useOutletContext } from "react-router";
 import { useOrganizationId } from "/hooks/useOrganizationId";
@@ -153,6 +156,7 @@ type Props = {
  */
 export default function FrameworkControlPage({ queryRef }: Props) {
   const { __ } = useTranslate();
+  const { toast } = useToast();
   const { framework } = useOutletContext<{
     framework: FrameworkDetailPageFragment$data;
   }>();
@@ -161,25 +165,44 @@ export default function FrameworkControlPage({ queryRef }: Props) {
   const organizationId = useOrganizationId();
   const confirm = useConfirm();
   const navigate = useNavigate();
-  // Mutations
-  const [detachMeasure, isDetachingMeasure] = useMutation(
-    detachMeasureMutation
-  );
-  const [attachMeasure, isAttachingMeasure] = useMutation(
-    attachMeasureMutation
-  );
-  const [detachDocument, isDetachingDocument] = useMutation(
-    detachDocumentMutation
-  );
-  const [attachDocument, isAttachingDocument] = useMutation(
-    attachDocumentMutation
-  );
+
+  const [detachMeasure, isDetachingMeasure] = useMutation(detachMeasureMutation);
+  const [attachMeasure, isAttachingMeasure] = useMutation(attachMeasureMutation);
+  const [detachDocument, isDetachingDocument] = useMutation(detachDocumentMutation);
+  const [attachDocument, isAttachingDocument] = useMutation(attachDocumentMutation);
   const [detachAudit, isDetachingAudit] = useMutation(detachAuditMutation);
   const [attachAudit, isAttachingAudit] = useMutation(attachAuditMutation);
   const [detachSnapshot, isDetachingSnapshot] = useMutation(detachSnapshotMutation);
   const [attachSnapshot, isAttachingSnapshot] = useMutation(attachSnapshotMutation);
   const [deleteControl] = useMutation(deleteControlMutation);
 
+  const withErrorHandling = <T extends MutationParameters>(
+    mutationFn: (config: UseMutationConfig<T>) => void,
+    errorMessage: string
+  ) => (options: UseMutationConfig<T>) => {
+    mutationFn({
+      ...options,
+      onCompleted: (response, error) => {
+        if (error) {
+          toast({
+            title: __("Error"),
+            description: formatError(errorMessage, error as GraphQLError),
+            variant: "error",
+          });
+        }
+        options.onCompleted?.(response, error);
+      },
+      onError: (error) => {
+        toast({
+          title: __("Error"),
+          description: formatError(errorMessage, error as GraphQLError),
+          variant: "error",
+        });
+        options.onError?.(error);
+      },
+    });
+  };
+
   const onDelete = () => {
     confirm(
       () => {
@@ -253,8 +276,8 @@ export default function FrameworkControlPage({ queryRef }: Props) {
             measures={control.measures?.edges.map((edge) => edge.node) ?? []}
             params={{ controlId: control.id }}
             connectionId={control.measures?.__id!}
-            onAttach={attachMeasure}
-            onDetach={detachMeasure}
+            onAttach={withErrorHandling(attachMeasure, __("Failed to link measure"))}
+            onDetach={withErrorHandling(detachMeasure, __("Failed to unlink measure"))}
             disabled={isAttachingMeasure || isDetachingMeasure}
           />
         </div>
@@ -264,8 +287,8 @@ export default function FrameworkControlPage({ queryRef }: Props) {
             documents={control.documents?.edges.map((edge) => edge.node) ?? []}
             params={{ controlId: control.id }}
             connectionId={control.documents?.__id!}
-            onAttach={attachDocument}
-            onDetach={detachDocument}
+            onAttach={withErrorHandling(attachDocument, __("Failed to link document"))}
+            onDetach={withErrorHandling(detachDocument, __("Failed to unlink document"))}
             disabled={isAttachingDocument || isDetachingDocument}
           />
         </div>
@@ -275,8 +298,8 @@ export default function FrameworkControlPage({ queryRef }: Props) {
             audits={control.audits?.edges.map((edge) => edge.node) ?? []}
             params={{ controlId: control.id }}
             connectionId={control.audits?.__id!}
-            onAttach={attachAudit}
-            onDetach={detachAudit}
+            onAttach={withErrorHandling(attachAudit, __("Failed to link audit"))}
+            onDetach={withErrorHandling(detachAudit, __("Failed to unlink audit"))}
             disabled={isAttachingAudit || isDetachingAudit}
           />
         </div>
@@ -286,8 +309,8 @@ export default function FrameworkControlPage({ queryRef }: Props) {
             snapshots={control.snapshots?.edges.map((edge) => edge.node) ?? []}
             params={{ controlId: control.id }}
             connectionId={control.snapshots?.__id!}
-            onAttach={attachSnapshot}
-            onDetach={detachSnapshot}
+            onAttach={withErrorHandling(attachSnapshot, __("Failed to link snapshot"))}
+            onDetach={withErrorHandling(detachSnapshot, __("Failed to unlink snapshot"))}
             disabled={isAttachingSnapshot || isDetachingSnapshot}
           />
         </div>
diff --git a/apps/console/src/pages/organizations/frameworks/dialogs/FrameworkControlDialog.tsx b/apps/console/src/pages/organizations/frameworks/dialogs/FrameworkControlDialog.tsx
index e806d6656..9aa3ba8b0 100644
--- a/apps/console/src/pages/organizations/frameworks/dialogs/FrameworkControlDialog.tsx
+++ b/apps/console/src/pages/organizations/frameworks/dialogs/FrameworkControlDialog.tsx
@@ -86,11 +86,11 @@ export function FrameworkControlDialog(props: Props) {
   const [mutate, isMutating] = props.control
     ? useMutationWithToasts(updateMutation, {
         successMessage: __("Control updated successfully."),
-        errorMessage: __("Failed to update control. Please try again."),
+        errorMessage: __("Failed to update control"),
       })
     : useMutationWithToasts(createMutation, {
         successMessage: __("Control created successfully."),
-        errorMessage: __("Failed to create control. Please try again."),
+        errorMessage: __("Failed to create control"),
       });
 
   const defaultValues = useMemo(() => ({
diff --git a/apps/console/src/pages/organizations/measures/MeasuresPage.tsx b/apps/console/src/pages/organizations/measures/MeasuresPage.tsx
index 2ebe638a6..67eac2912 100644
--- a/apps/console/src/pages/organizations/measures/MeasuresPage.tsx
+++ b/apps/console/src/pages/organizations/measures/MeasuresPage.tsx
@@ -107,7 +107,7 @@ export default function MeasuresPage(props: Props) {
     importMeasuresMutation,
     {
       successMessage: __("Measures imported successfully."),
-      errorMessage: __("Failed to import measures. Please try again."),
+      errorMessage: __("Failed to import measures"),
     }
   );
   const importFileRef = useRef<HTMLInputElement>(null);
diff --git a/apps/console/src/pages/organizations/measures/dialog/MeasureFormDialog.tsx b/apps/console/src/pages/organizations/measures/dialog/MeasureFormDialog.tsx
index 811c9db94..87e4b34f1 100644
--- a/apps/console/src/pages/organizations/measures/dialog/MeasureFormDialog.tsx
+++ b/apps/console/src/pages/organizations/measures/dialog/MeasureFormDialog.tsx
@@ -3,11 +3,11 @@ import {
   Dialog,
   DialogContent,
   DialogFooter,
+  Field,
   Input,
   Label,
   Option,
   PropertyRow,
-  Textarea,
   useDialogRef,
   type DialogRef,
 } from "@probo/ui";
@@ -51,9 +51,9 @@ const measureCreateMutation = graphql`
 `;
 
 const measureSchema = z.object({
-  name: z.string(),
-  description: z.string(),
-  category: z.string(),
+  name: z.string().min(1, "Name is required"),
+  description: z.string().min(1, "Description is required"),
+  category: z.string().min(1, "Category is required"),
   state: z.enum(measureStates),
 });
 
@@ -73,7 +73,7 @@ export default function MeasureFormDialog(props: Props) {
     ? useUpdateMeasure()
     : useMutationWithToasts(measureCreateMutation, {
         successMessage: __("Measure created successfully."),
-        errorMessage: __("Failed to create measure. Please try again."),
+        errorMessage: __("Failed to create measure"),
       });
 
   const { control, handleSubmit, register, formState, reset } =
@@ -131,20 +131,21 @@ export default function MeasureFormDialog(props: Props) {
     >
       <form onSubmit={onSubmit}>
         <DialogContent className="grid grid-cols-[1fr_420px]">
-          <div className="py-8 px-10 space-y-4">
-            <Input
-              id="title"
-              required
-              variant="title"
-              placeholder={__("Measure title")}
+          <div className="py-8 px-10 space-y-6">
+            <Field
               {...register("name")}
+              error={formState.errors.name?.message}
+              label={__("Measure name")}
+              placeholder={__("Measure title")}
+              required
             />
-            <Textarea
-              id="content"
-              variant="ghost"
-              autogrow
-              placeholder={__("Add description")}
+            <Field
               {...register("description")}
+              error={formState.errors.description?.message}
+              label={__("Description")}
+              placeholder={__("Add description")}
+              type="textarea"
+              required
             />
           </div>
           {/* Properties form */}
diff --git a/apps/console/src/pages/organizations/nonconformities/NonconformityDetailsPage.tsx b/apps/console/src/pages/organizations/nonconformities/NonconformityDetailsPage.tsx
index 007bed266..5dd7a0553 100644
--- a/apps/console/src/pages/organizations/nonconformities/NonconformityDetailsPage.tsx
+++ b/apps/console/src/pages/organizations/nonconformities/NonconformityDetailsPage.tsx
@@ -32,7 +32,7 @@ import { PeopleSelectField } from "/components/form/PeopleSelectField";
 import { AuditSelectField } from "/components/form/AuditSelectField";
 import { useFormWithSchema } from "/hooks/useFormWithSchema";
 import z from "zod";
-import { getStatusVariant, getStatusLabel, formatDatetime, validateSnapshotConsistency, getStatusOptions } from "@probo/helpers";
+import { getStatusVariant, getStatusLabel, formatDatetime, validateSnapshotConsistency, getStatusOptions, formatError, type GraphQLError } from "@probo/helpers";
 import type { NonconformityGraphNodeQuery } from "/hooks/graph/__generated__/NonconformityGraphNodeQuery.graphql";
 
 const updateNonconformitySchema = z.object({
@@ -121,7 +121,7 @@ export default function NonconformityDetailsPage(props: Props) {
     } catch (error) {
       toast({
         title: __("Error"),
-        description: error instanceof Error ? error.message : __("Failed to update nonconformity"),
+        description: formatError(__("Failed to update nonconformity"), error as GraphQLError),
         variant: "error",
       });
     }
diff --git a/apps/console/src/pages/organizations/nonconformities/dialogs/CreateNonconformityDialog.tsx b/apps/console/src/pages/organizations/nonconformities/dialogs/CreateNonconformityDialog.tsx
index 7751f5e3d..a41e3f828 100644
--- a/apps/console/src/pages/organizations/nonconformities/dialogs/CreateNonconformityDialog.tsx
+++ b/apps/console/src/pages/organizations/nonconformities/dialogs/CreateNonconformityDialog.tsx
@@ -21,6 +21,7 @@ import { useCreateNonconformity } from "../../../../hooks/graph/NonconformityGra
 import { PeopleSelectField } from "/components/form/PeopleSelectField";
 import { AuditSelectField } from "/components/form/AuditSelectField";
 import { Controller } from "react-hook-form";
+import { formatError, type GraphQLError } from "@probo/helpers";
 import { formatDatetime, getStatusOptions } from "@probo/helpers";
 
 const schema = z.object({
@@ -98,7 +99,7 @@ export function CreateNonconformityDialog({
     } catch (error) {
       toast({
         title: __("Error"),
-        description: __("Failed to create nonconformity"),
+        description: formatError(__("Failed to create nonconformity"), error as GraphQLError),
         variant: "error",
       });
     }
diff --git a/apps/console/src/pages/organizations/obligations/ObligationDetailsPage.tsx b/apps/console/src/pages/organizations/obligations/ObligationDetailsPage.tsx
index dfb92b5a9..80fc472fc 100644
--- a/apps/console/src/pages/organizations/obligations/ObligationDetailsPage.tsx
+++ b/apps/console/src/pages/organizations/obligations/ObligationDetailsPage.tsx
@@ -30,6 +30,7 @@ import { useOrganizationId } from "/hooks/useOrganizationId";
 import { PeopleSelectField } from "/components/form/PeopleSelectField";
 import { useFormWithSchema } from "/hooks/useFormWithSchema";
 import { Controller } from "react-hook-form";
+import { formatError, type GraphQLError } from "@probo/helpers";
 import z from "zod";
 import { getObligationStatusVariant, getObligationStatusLabel, formatDatetime, getObligationStatusOptions, validateSnapshotConsistency } from "@probo/helpers";
 import { SnapshotBanner } from "/components/SnapshotBanner";
@@ -120,10 +121,10 @@ export default function ObligationDetailsPage(props: Props) {
         description: __("Obligation updated successfully"),
         variant: "success",
       });
-    } catch {
+    } catch (error) {
       toast({
         title: __("Error"),
-        description: __("Failed to update obligation"),
+        description: formatError(__("Failed to update obligation"), error as GraphQLError),
         variant: "error",
       });
     }
diff --git a/apps/console/src/pages/organizations/obligations/dialogs/CreateObligationDialog.tsx b/apps/console/src/pages/organizations/obligations/dialogs/CreateObligationDialog.tsx
index 3a39f2a49..225e72a4d 100644
--- a/apps/console/src/pages/organizations/obligations/dialogs/CreateObligationDialog.tsx
+++ b/apps/console/src/pages/organizations/obligations/dialogs/CreateObligationDialog.tsx
@@ -20,6 +20,7 @@ import { useFormWithSchema } from "/hooks/useFormWithSchema";
 import { useCreateObligation } from "../../../../hooks/graph/ObligationGraph";
 import { PeopleSelectField } from "/components/form/PeopleSelectField";
 import { Controller } from "react-hook-form";
+import { formatError, type GraphQLError } from "@probo/helpers";
 import { formatDatetime, getObligationStatusOptions } from "@probo/helpers";
 
 const schema = z.object({
@@ -91,10 +92,10 @@ export function CreateObligationDialog({
 
       reset();
       dialogRef.current?.close();
-    } catch {
+    } catch (error) {
       toast({
         title: __("Error"),
-        description: __("Failed to create obligation"),
+        description: formatError(__("Failed to create obligation"), error as GraphQLError),
         variant: "error",
       });
     }
diff --git a/apps/console/src/pages/organizations/people/dialogs/CreatePeopleDialog.tsx b/apps/console/src/pages/organizations/people/dialogs/CreatePeopleDialog.tsx
index ebf16e0d2..40b5f3c0b 100644
--- a/apps/console/src/pages/organizations/people/dialogs/CreatePeopleDialog.tsx
+++ b/apps/console/src/pages/organizations/people/dialogs/CreatePeopleDialog.tsx
@@ -68,7 +68,7 @@ export function CreatePeopleDialog({ children, connectionId }: Props) {
 
   const [mutate, isMutating] = useMutationWithToasts(createPeopleMutation, {
     successMessage: __("Person created successfully."),
-    errorMessage: __("Failed to create person. Please try again."),
+    errorMessage: __("Failed to create person"),
   });
 
   const onSubmit = handleSubmit((data) => {
diff --git a/apps/console/src/pages/organizations/people/tabs/PeopleProfileTab.tsx b/apps/console/src/pages/organizations/people/tabs/PeopleProfileTab.tsx
index 212fc6727..1e25f0318 100644
--- a/apps/console/src/pages/organizations/people/tabs/PeopleProfileTab.tsx
+++ b/apps/console/src/pages/organizations/people/tabs/PeopleProfileTab.tsx
@@ -45,7 +45,7 @@ export default function PeopleProfileTab() {
     updatePeopleMutation,
     {
       successMessage: __("Member updated successfully."),
-      errorMessage: __("Failed to update member. Please try again."),
+      errorMessage: __("Failed to update member"),
     }
   );
 
diff --git a/apps/console/src/pages/organizations/people/tabs/PeopleRoleTab.tsx b/apps/console/src/pages/organizations/people/tabs/PeopleRoleTab.tsx
index 33d00edda..cde1c7cf9 100644
--- a/apps/console/src/pages/organizations/people/tabs/PeopleRoleTab.tsx
+++ b/apps/console/src/pages/organizations/people/tabs/PeopleRoleTab.tsx
@@ -33,7 +33,7 @@ export default function PeopleRoleTab() {
     updatePeopleMutation,
     {
       successMessage: __("Member updated successfully."),
-      errorMessage: __("Failed to update member. Please try again."),
+      errorMessage: __("Failed to update member"),
     }
   );
 
diff --git a/apps/console/src/pages/organizations/processingActivities/ProcessingActivityDetailsPage.tsx b/apps/console/src/pages/organizations/processingActivities/ProcessingActivityDetailsPage.tsx
index 34e3e35c9..9ff1dccdd 100644
--- a/apps/console/src/pages/organizations/processingActivities/ProcessingActivityDetailsPage.tsx
+++ b/apps/console/src/pages/organizations/processingActivities/ProcessingActivityDetailsPage.tsx
@@ -27,6 +27,7 @@ import { useOrganizationId } from "/hooks/useOrganizationId";
 import { useParams } from "react-router";
 import { useFormWithSchema } from "/hooks/useFormWithSchema";
 import { Controller } from "react-hook-form";
+import { formatError, type GraphQLError } from "@probo/helpers";
 import z from "zod";
 import { validateSnapshotConsistency } from "@probo/helpers";
 import { SnapshotBanner } from "/components/SnapshotBanner";
@@ -146,7 +147,7 @@ export default function ProcessingActivityDetailsPage(props: Props) {
     } catch (error) {
       toast({
         title: __("Error"),
-        description: __("Failed to update processing activity"),
+        description: formatError(__("Failed to update processing activity"), error as GraphQLError),
         variant: "error",
       });
     }
diff --git a/apps/console/src/pages/organizations/processingActivities/dialogs/CreateProcessingActivityDialog.tsx b/apps/console/src/pages/organizations/processingActivities/dialogs/CreateProcessingActivityDialog.tsx
index d72c35010..b9e049463 100644
--- a/apps/console/src/pages/organizations/processingActivities/dialogs/CreateProcessingActivityDialog.tsx
+++ b/apps/console/src/pages/organizations/processingActivities/dialogs/CreateProcessingActivityDialog.tsx
@@ -19,6 +19,7 @@ import { useFormWithSchema } from "/hooks/useFormWithSchema";
 import { useCreateProcessingActivity } from "../../../../hooks/graph/ProcessingActivityGraph";
 import { Controller } from "react-hook-form";
 import { VendorsMultiSelectField } from "/components/form/VendorsMultiSelectField";
+import { formatError, type GraphQLError } from "@probo/helpers";
 import {
   SpecialOrCriminalDataOptions,
   LawfulBasisOptions,
@@ -119,7 +120,7 @@ export function CreateProcessingActivityDialog({
     } catch (error) {
       toast({
         title: __("Error"),
-        description: __("Failed to create processing activity"),
+        description: formatError(__("Failed to create processing activity"), error as GraphQLError),
         variant: "error",
       });
     }
diff --git a/apps/console/src/pages/organizations/risks/FormRiskDialog.tsx b/apps/console/src/pages/organizations/risks/FormRiskDialog.tsx
index 46c559854..d6de4e277 100644
--- a/apps/console/src/pages/organizations/risks/FormRiskDialog.tsx
+++ b/apps/console/src/pages/organizations/risks/FormRiskDialog.tsx
@@ -113,7 +113,7 @@ export default function FormRiskDialog({
           },
         },
         successMessage: __("Risk updated successfully."),
-        errorMessage: __("Failed to update risk. Please try again."),
+        errorMessage: __("Failed to update risk"),
         onSuccess: () => {
           ref?.current?.close();
         },
@@ -129,7 +129,7 @@ export default function FormRiskDialog({
         connections: [connection!],
       },
       successMessage: __("Risk created successfully."),
-      errorMessage: __("Failed to create risk. Please try again."),
+      errorMessage: __("Failed to create risk"),
       onSuccess: () => {
         ref?.current?.close();
         reset();
diff --git a/apps/console/src/pages/organizations/snapshots/dialog/SnapshotFormDialog.tsx b/apps/console/src/pages/organizations/snapshots/dialog/SnapshotFormDialog.tsx
index 729ceaa51..70c651342 100644
--- a/apps/console/src/pages/organizations/snapshots/dialog/SnapshotFormDialog.tsx
+++ b/apps/console/src/pages/organizations/snapshots/dialog/SnapshotFormDialog.tsx
@@ -57,7 +57,7 @@ export default function SnapshotFormDialog(props: Props) {
   const organizationId = useOrganizationId();
   const [mutate] = useMutationWithToasts(snapshotCreateMutation, {
     successMessage: __("Snapshot created successfully."),
-    errorMessage: __("Failed to create snapshot. Please try again."),
+    errorMessage: __("Failed to create snapshot"),
   });
 
   const { handleSubmit, register, reset, control, formState: { errors } } =
diff --git a/apps/console/src/pages/organizations/trustCenter/TrustCenterAccessTab.tsx b/apps/console/src/pages/organizations/trustCenter/TrustCenterAccessTab.tsx
index f3b03ddb7..a6103b113 100644
--- a/apps/console/src/pages/organizations/trustCenter/TrustCenterAccessTab.tsx
+++ b/apps/console/src/pages/organizations/trustCenter/TrustCenterAccessTab.tsx
@@ -142,15 +142,15 @@ export default function TrustCenterAccessTab() {
 
   const [createInvitation, isCreating] = useMutationWithToasts(createTrustCenterAccessMutation, {
     successMessage: __("Access created successfully"),
-    errorMessage: __("Failed to create access. Please try again."),
+    errorMessage: __("Failed to create access"),
   });
   const [updateInvitation, isUpdating] = useMutationWithToasts(updateTrustCenterAccessMutation, {
     successMessage: __("Access updated successfully"),
-    errorMessage: __("Failed to update access. Please try again."),
+    errorMessage: __("Failed to update access"),
   });
   const [deleteInvitation, isDeleting] = useMutationWithToasts(deleteTrustCenterAccessMutation, {
     successMessage: __("Access deleted successfully"),
-    errorMessage: __("Failed to delete access. Please try again."),
+    errorMessage: __("Failed to delete access"),
   });
 
   const dialogRef = useDialogRef();
diff --git a/apps/console/src/pages/organizations/vendors/dialogs/CreateContactDialog.tsx b/apps/console/src/pages/organizations/vendors/dialogs/CreateContactDialog.tsx
index 8bea0b070..20d348dce 100644
--- a/apps/console/src/pages/organizations/vendors/dialogs/CreateContactDialog.tsx
+++ b/apps/console/src/pages/organizations/vendors/dialogs/CreateContactDialog.tsx
@@ -47,8 +47,8 @@ export function CreateContactDialog({
 
   const schema = z.object({
     fullName: z.string().optional(),
-    email: z.string().email(__("Please enter a valid email address")).optional().or(z.literal("")),
-    phone: z.string().regex(phoneRegex, __("Phone number must be in international format (e.g., +1234567890)")).optional().or(z.literal("")),
+    email: z.union([z.string().email(__("Please enter a valid email address")), z.literal("")]),
+    phone: z.union([z.string().regex(phoneRegex, __("Phone number must be in international format (e.g., +1234567890)")), z.literal("")]),
     role: z.string().optional(),
   });
 
@@ -67,7 +67,7 @@ export function CreateContactDialog({
     createContactMutation,
     {
       successMessage: __("Contact created successfully."),
-      errorMessage: __("Failed to create contact. Please try again."),
+      errorMessage: __("Failed to create contact"),
     }
   );
 
diff --git a/apps/console/src/pages/organizations/vendors/dialogs/CreateRiskAssessmentDialog.tsx b/apps/console/src/pages/organizations/vendors/dialogs/CreateRiskAssessmentDialog.tsx
index 047bd3055..e7f356418 100644
--- a/apps/console/src/pages/organizations/vendors/dialogs/CreateRiskAssessmentDialog.tsx
+++ b/apps/console/src/pages/organizations/vendors/dialogs/CreateRiskAssessmentDialog.tsx
@@ -65,7 +65,7 @@ export function CreateRiskAssessmentDialog({
     createRiskAssessmentMutation,
     {
       successMessage: __("Risk Assessment created successfully."),
-      errorMessage: __("Failed to create Risk Assessment. Please try again."),
+      errorMessage: __("Failed to create Risk Assessment"),
     }
   );
 
diff --git a/apps/console/src/pages/organizations/vendors/dialogs/CreateServiceDialog.tsx b/apps/console/src/pages/organizations/vendors/dialogs/CreateServiceDialog.tsx
index 3510b6f8a..4d94e2e89 100644
--- a/apps/console/src/pages/organizations/vendors/dialogs/CreateServiceDialog.tsx
+++ b/apps/console/src/pages/organizations/vendors/dialogs/CreateServiceDialog.tsx
@@ -61,7 +61,7 @@ export function CreateServiceDialog({
     createServiceMutation,
     {
       successMessage: __("Service created successfully."),
-      errorMessage: __("Failed to create service. Please try again."),
+      errorMessage: __("Failed to create service"),
     }
   );
 
diff --git a/apps/console/src/pages/organizations/vendors/dialogs/EditContactDialog.tsx b/apps/console/src/pages/organizations/vendors/dialogs/EditContactDialog.tsx
index 8c1ddcb27..73c346ea5 100644
--- a/apps/console/src/pages/organizations/vendors/dialogs/EditContactDialog.tsx
+++ b/apps/console/src/pages/organizations/vendors/dialogs/EditContactDialog.tsx
@@ -43,8 +43,8 @@ export function EditContactDialog({ contactId, contact, onClose }: Props) {
 
   const schema = z.object({
     fullName: z.string().optional(),
-    email: z.string().email(__("Please enter a valid email address")).optional().or(z.literal("")),
-    phone: z.string().regex(phoneRegex, __("Phone number must be in international format (e.g., +1234567890)")).optional().or(z.literal("")),
+    email: z.union([z.string().email(__("Please enter a valid email address")), z.literal("")]),
+    phone: z.union([z.string().regex(phoneRegex, __("Phone number must be in international format (e.g., +1234567890)")), z.literal("")]),
     role: z.string().optional(),
   });
 
@@ -64,7 +64,7 @@ export function EditContactDialog({ contactId, contact, onClose }: Props) {
     updateContactMutation,
     {
       successMessage: __("Contact updated successfully."),
-      errorMessage: __("Failed to update contact. Please try again."),
+      errorMessage: __("Failed to update contact"),
     }
   );
 
diff --git a/apps/console/src/pages/organizations/vendors/dialogs/EditServiceDialog.tsx b/apps/console/src/pages/organizations/vendors/dialogs/EditServiceDialog.tsx
index 8ce3a13bb..f3378146e 100644
--- a/apps/console/src/pages/organizations/vendors/dialogs/EditServiceDialog.tsx
+++ b/apps/console/src/pages/organizations/vendors/dialogs/EditServiceDialog.tsx
@@ -56,7 +56,7 @@ export function EditServiceDialog({ serviceId, service, onClose }: Props) {
     updateServiceMutation,
     {
       successMessage: __("Service updated successfully."),
-      errorMessage: __("Failed to update service. Please try again."),
+      errorMessage: __("Failed to update service"),
     }
   );
 
diff --git a/apps/console/src/pages/organizations/vendors/dialogs/ImportAssessmentDialog.tsx b/apps/console/src/pages/organizations/vendors/dialogs/ImportAssessmentDialog.tsx
index 3fef55533..b6bb8ff0b 100644
--- a/apps/console/src/pages/organizations/vendors/dialogs/ImportAssessmentDialog.tsx
+++ b/apps/console/src/pages/organizations/vendors/dialogs/ImportAssessmentDialog.tsx
@@ -52,7 +52,7 @@ export function ImportAssessmentDialog({ vendorId, children }: Props) {
     importAssessmentMutation,
     {
       successMessage: __("Vendor assessed successfully."),
-      errorMessage: __("Failed to assess vendor. Please try again."),
+      errorMessage: __("Failed to assess vendor"),
     }
   );
 
diff --git a/apps/console/src/providers/RelayProviders.tsx b/apps/console/src/providers/RelayProviders.tsx
index 59a880fc3..4d69a432d 100644
--- a/apps/console/src/providers/RelayProviders.tsx
+++ b/apps/console/src/providers/RelayProviders.tsx
@@ -44,6 +44,13 @@ export class AuthenticationRequiredError extends Error {
   }
 }
 
+export class UnauthorizedError extends Error {
+  constructor() {
+    super("UNAUTHORIZED");
+    this.name = "UnauthorizedError";
+  }
+}
+
 export function buildEndpoint(path: string): string {
   const host = import.meta.env.VITE_API_URL;
 
@@ -71,6 +78,9 @@ const hasUnauthenticatedError = (error: GraphQLError) =>
 const hasAuthenticationRequiredError = (error: GraphQLError) =>
   error.extensions?.code == "AUTHENTICATION_REQUIRED";
 
+const hasUnauthorizedError = (error: GraphQLError) =>
+  error.extensions?.code == "UNAUTHORIZED";
+
 const fetchRelay: FetchFunction = async (
   request,
   variables,
@@ -141,12 +151,10 @@ const fetchRelay: FetchFunction = async (
       throw new UnAuthenticatedError();
     }
 
-    // Check for authentication required errors
     const authRequiredError = errors.find(hasAuthenticationRequiredError);
     if (authRequiredError?.extensions) {
       const { redirectUrl, requiresSaml, organizationId, samlConfigId } = authRequiredError.extensions;
 
-      // Throw the error with all the redirect information
       throw new AuthenticationRequiredError({
         redirectUrl: redirectUrl as string,
         requiresSaml: requiresSaml as boolean,
@@ -155,13 +163,9 @@ const fetchRelay: FetchFunction = async (
       });
     }
 
-    throw new Error(
-      `Error fetching GraphQL query '${
-        request.name
-      }' with variables '${JSON.stringify(variables)}': ${JSON.stringify(
-        json.errors
-      )}`
-    );
+    if (errors.find(hasUnauthorizedError)) {
+      throw new UnauthorizedError();
+    }
   }
 
   return json;
diff --git a/apps/console/src/routes.tsx b/apps/console/src/routes.tsx
index c1823efe0..217987041 100644
--- a/apps/console/src/routes.tsx
+++ b/apps/console/src/routes.tsx
@@ -12,6 +12,7 @@ import { Fragment, Suspense } from "react";
 import {
   relayEnvironment,
   UnAuthenticatedError,
+  UnauthorizedError,
 } from "./providers/RelayProviders";
 import { PageSkeleton } from "./components/skeletons/PageSkeleton.tsx";
 import { loadQuery, type PreloadedQuery } from "react-relay";
@@ -53,6 +54,10 @@ function ErrorBoundary({ error: propsError }: { error?: string }) {
     return <Navigate to="/auth/login" />;
   }
 
+  if (error instanceof UnauthorizedError) {
+    return <PageError error="UNAUTHORIZED" />;
+  }
+
   return <PageError error={error?.toString()} />;
 }
 
diff --git a/packages/helpers/src/error.ts b/packages/helpers/src/error.ts
new file mode 100644
index 000000000..dc87e0aae
--- /dev/null
+++ b/packages/helpers/src/error.ts
@@ -0,0 +1,26 @@
+export interface GraphQLError {
+  message?: string;
+  source?: {
+    errors?: Array<{ message: string }>;
+  };
+}
+
+export function formatError(title: string, error: GraphQLError | GraphQLError[]): string {
+  const messages: string[] = [];
+
+  if (Array.isArray(error)) {
+    messages.push(...error.map((e) => e.message).filter(Boolean) as string[]);
+  } else if (error.source?.errors && Array.isArray(error.source.errors)) {
+    messages.push(...error.source.errors.map((e) => e.message).filter(Boolean));
+  } else if (error.message) {
+    messages.push(error.message);
+  }
+
+  if (messages.length === 0) {
+    return title;
+  }
+
+  const errorList = messages.join(", ");
+
+  return `${title}: ${errorList}${errorList.endsWith('.') ? '' : '.'}`;
+}
diff --git a/packages/helpers/src/index.ts b/packages/helpers/src/index.ts
index 8296aebf3..647210cc1 100644
--- a/packages/helpers/src/index.ts
+++ b/packages/helpers/src/index.ts
@@ -59,3 +59,4 @@ export { promisifyMutation } from "./relay";
 export { fileType, fileSize } from "./file";
 export { formatDatetime, formatDate } from "./date";
 export { getLogoUrl, getTrustCenterUrl } from "./trustCenter";
+export { formatError, type GraphQLError } from "./error";
diff --git a/packages/ui/src/Layouts/ErrorLayout.stories.tsx b/packages/ui/src/Layouts/ErrorLayout.stories.tsx
index 0bf06ab5f..0c75c2acf 100644
--- a/packages/ui/src/Layouts/ErrorLayout.stories.tsx
+++ b/packages/ui/src/Layouts/ErrorLayout.stories.tsx
@@ -12,6 +12,6 @@ type Story = StoryObj<typeof ErrorLayout>;
 export const Default: Story = {
     args: {
         title: "Something went wrong",
-        description: "An unexpected error occurred. Please try again later.",
+        description: "An unexpected error occurred",
     },
 };
diff --git a/packages/ui/src/Molecules/Dialog/ConfirmDialog.tsx b/packages/ui/src/Molecules/Dialog/ConfirmDialog.tsx
index 03cbe6877..b8c159916 100644
--- a/packages/ui/src/Molecules/Dialog/ConfirmDialog.tsx
+++ b/packages/ui/src/Molecules/Dialog/ConfirmDialog.tsx
@@ -82,10 +82,8 @@ export function ConfirmDialog() {
     const handleConfirm = () => {
         setLoading(true);
         onConfirm()
-            .then(() => {
-                close();
-            })
             .finally(() => {
+                close();
                 setLoading(false);
             });
     };
diff --git a/pkg/authz/service.go b/pkg/authz/service.go
index 8c6e3260f..f607d4f27 100644
--- a/pkg/authz/service.go
+++ b/pkg/authz/service.go
@@ -29,6 +29,14 @@ import (
 	"go.gearno.de/kit/pg"
 )
 
+type TenantAccessError struct {
+	Message string
+}
+
+func (e *TenantAccessError) Error() string {
+	return "not authorized"
+}
+
 type (
 	Service struct {
 		pg                      *pg.Client
diff --git a/pkg/coredata/asset.go b/pkg/coredata/asset.go
index ca926ac36..42e2cbbd2 100644
--- a/pkg/coredata/asset.go
+++ b/pkg/coredata/asset.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -42,8 +43,24 @@ type (
 	}
 
 	Assets []*Asset
+
+	ErrAssetNotFound struct {
+		Identifier string
+	}
+
+	ErrAssetAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrAssetNotFound) Error() string {
+	return fmt.Sprintf("asset not found: %q", e.Identifier)
+}
+
+func (e ErrAssetAlreadyExists) Error() string {
+	return e.message
+}
+
 func (a *Asset) CursorKey(field AssetOrderField) page.CursorKey {
 	switch field {
 	case AssetOrderFieldCreatedAt:
@@ -94,6 +111,10 @@ LIMIT 1;
 
 	asset, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Asset])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrAssetNotFound{Identifier: assetID.String()}
+		}
+
 		return fmt.Errorf("cannot collect asset: %w", err)
 	}
 
@@ -140,6 +161,10 @@ LIMIT 1;
 
 	asset, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Asset])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrAssetNotFound{Identifier: a.OwnerID.String()}
+		}
+
 		return fmt.Errorf("cannot collect asset: %w", err)
 	}
 
diff --git a/pkg/coredata/audit.go b/pkg/coredata/audit.go
index 998a62cd7..5b576c652 100644
--- a/pkg/coredata/audit.go
+++ b/pkg/coredata/audit.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -42,8 +43,24 @@ type (
 	}
 
 	Audits []*Audit
+
+	ErrAuditNotFound struct {
+		Identifier string
+	}
+
+	ErrAuditAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrAuditNotFound) Error() string {
+	return fmt.Sprintf("audit not found: %q", e.Identifier)
+}
+
+func (e ErrAuditAlreadyExists) Error() string {
+	return e.message
+}
+
 func (a *Audit) CursorKey(field AuditOrderField) page.CursorKey {
 	switch field {
 	case AuditOrderFieldCreatedAt:
@@ -98,6 +115,10 @@ LIMIT 1;
 
 	audit, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Audit])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrAuditNotFound{Identifier: auditID.String()}
+		}
+
 		return fmt.Errorf("cannot collect audit: %w", err)
 	}
 
@@ -508,6 +529,10 @@ LIMIT 1;
 
 	audit, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Audit])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrAuditNotFound{Identifier: reportID.String()}
+		}
+
 		return fmt.Errorf("cannot collect audit: %w", err)
 	}
 
diff --git a/pkg/coredata/control.go b/pkg/coredata/control.go
index 0707ff086..090425132 100644
--- a/pkg/coredata/control.go
+++ b/pkg/coredata/control.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -48,8 +50,24 @@ type (
 		Status                 *ControlStatus
 		ExclusionJustification *string
 	}
+
+	ErrControlNotFound struct {
+		Identifier string
+	}
+
+	ErrControlAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrControlNotFound) Error() string {
+	return fmt.Sprintf("control not found: %q", e.Identifier)
+}
+
+func (e ErrControlAlreadyExists) Error() string {
+	return e.message
+}
+
 func (c Control) CursorKey(orderBy ControlOrderField) page.CursorKey {
 	switch orderBy {
 	case ControlOrderFieldCreatedAt:
@@ -628,6 +646,10 @@ LIMIT 1;
 
 	control, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Control])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrControlNotFound{Identifier: fmt.Sprintf("%s:%s", frameworkID, sectionTitle)}
+		}
+
 		return fmt.Errorf("cannot collect control: %w", err)
 	}
 
@@ -671,6 +693,10 @@ LIMIT 1;
 
 	control, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Control])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrControlNotFound{Identifier: controlID.String()}
+		}
+
 		return fmt.Errorf("cannot collect control: %w", err)
 	}
 
@@ -725,7 +751,20 @@ VALUES (
 		"updated_at":              c.UpdatedAt,
 	}
 	_, err := conn.Exec(ctx, q, args)
-	return err
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "controls_framework_ref_unique" {
+				return &ErrControlAlreadyExists{
+					message: fmt.Sprintf("control with framework_id %s and section_title %q already exists", c.FrameworkID, c.SectionTitle),
+				}
+			}
+		}
+		return fmt.Errorf("cannot insert control: %w", err)
+	}
+
+	return nil
 }
 
 func (c Control) Delete(
@@ -810,6 +849,18 @@ RETURNING
 
 	control, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Control])
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "controls_framework_ref_unique" {
+				sectionTitle := ""
+				if params.SectionTitle != nil {
+					sectionTitle = *params.SectionTitle
+				}
+				return &ErrControlAlreadyExists{
+					message: fmt.Sprintf("control with section_title %q already exists", sectionTitle),
+				}
+			}
+		}
 		return fmt.Errorf("cannot collect control: %w", err)
 	}
 
diff --git a/pkg/coredata/custom_domain.go b/pkg/coredata/custom_domain.go
index 9aed48866..89fccad29 100644
--- a/pkg/coredata/custom_domain.go
+++ b/pkg/coredata/custom_domain.go
@@ -17,6 +17,7 @@ package coredata
 import (
 	"context"
 	"crypto/tls"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -25,6 +26,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -49,8 +51,24 @@ type (
 	}
 
 	CustomDomains []*CustomDomain
+
+	ErrCustomDomainNotFound struct {
+		Identifier string
+	}
+
+	ErrCustomDomainAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrCustomDomainNotFound) Error() string {
+	return fmt.Sprintf("custom domain not found: %q", e.Identifier)
+}
+
+func (e ErrCustomDomainAlreadyExists) Error() string {
+	return e.message
+}
+
 func NewCustomDomain(tenantID gid.TenantID, domain string) *CustomDomain {
 	now := time.Now()
 	return &CustomDomain{
@@ -357,6 +375,14 @@ INSERT INTO custom_domains (
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "custom_domains_domain_key" {
+				return &ErrCustomDomainAlreadyExists{
+					message: fmt.Sprintf("custom domain with domain %q already exists", cd.Domain),
+				}
+			}
+		}
 		return fmt.Errorf("cannot insert custom domain: %w", err)
 	}
 
diff --git a/pkg/coredata/document.go b/pkg/coredata/document.go
index c8ff33431..99ab968b7 100644
--- a/pkg/coredata/document.go
+++ b/pkg/coredata/document.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -41,8 +42,24 @@ type (
 	}
 
 	Documents []*Document
+
+	ErrDocumentNotFound struct {
+		Identifier string
+	}
+
+	ErrDocumentAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrDocumentNotFound) Error() string {
+	return fmt.Sprintf("document not found: %q", e.Identifier)
+}
+
+func (e ErrDocumentAlreadyExists) Error() string {
+	return e.message
+}
+
 func (p Document) CursorKey(orderBy DocumentOrderField) page.CursorKey {
 	switch orderBy {
 	case DocumentOrderFieldCreatedAt:
@@ -95,6 +112,10 @@ LIMIT 1;
 
 	document, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Document])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrDocumentNotFound{Identifier: documentID.String()}
+		}
+
 		return fmt.Errorf("cannot collect document: %w", err)
 	}
 
diff --git a/pkg/coredata/document_version.go b/pkg/coredata/document_version.go
index 148ccb095..08206fe6e 100644
--- a/pkg/coredata/document_version.go
+++ b/pkg/coredata/document_version.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -43,8 +45,32 @@ type (
 	}
 
 	DocumentVersions []*DocumentVersion
+
+	ErrDocumentVersionNotFound struct {
+		Identifier string
+	}
+
+	ErrDocumentVersionAlreadyExists struct {
+		message string
+	}
+
+	ErrDocumentVersionNoChanges struct {
+		Message string
+	}
 )
 
+func (e ErrDocumentVersionNotFound) Error() string {
+	return fmt.Sprintf("document version not found: %q", e.Identifier)
+}
+
+func (e ErrDocumentVersionAlreadyExists) Error() string {
+	return e.message
+}
+
+func (e ErrDocumentVersionNoChanges) Error() string {
+	return e.Message
+}
+
 func (p *DocumentVersions) LoadByDocumentID(
 	ctx context.Context,
 	conn pg.Conn,
@@ -207,6 +233,21 @@ VALUES (
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" {
+				if pgErr.ConstraintName == "document_versions_document_id_version_number_key" {
+					return &ErrDocumentVersionAlreadyExists{
+						message: fmt.Sprintf("document version with document_id %s and version_number %d already exists", p.DocumentID, p.VersionNumber),
+					}
+				}
+				if pgErr.ConstraintName == "document_one_draft_version_idx" {
+					return &ErrDocumentVersionAlreadyExists{
+						message: fmt.Sprintf("document %s already has a draft version", p.DocumentID),
+					}
+				}
+			}
+		}
 		return fmt.Errorf("error creating document version: %w", err)
 	}
 
diff --git a/pkg/coredata/document_version_signature.go b/pkg/coredata/document_version_signature.go
index 0d02e036f..d045f49f8 100644
--- a/pkg/coredata/document_version_signature.go
+++ b/pkg/coredata/document_version_signature.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -46,8 +48,24 @@ type (
 	}
 
 	DocumentVersionSignaturesWithPeople []*DocumentVersionSignatureWithPeople
+
+	ErrDocumentVersionSignatureNotFound struct {
+		Identifier string
+	}
+
+	ErrDocumentVersionSignatureAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrDocumentVersionSignatureNotFound) Error() string {
+	return fmt.Sprintf("document version signature not found: %q", e.Identifier)
+}
+
+func (e ErrDocumentVersionSignatureAlreadyExists) Error() string {
+	return e.message
+}
+
 func (pvs DocumentVersionSignature) CursorKey(orderBy DocumentVersionSignatureOrderField) page.CursorKey {
 	switch orderBy {
 	case DocumentVersionSignatureOrderFieldCreatedAt:
@@ -191,6 +209,14 @@ INSERT INTO document_version_signatures (
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "policy_version_signatures_policy_version_id_signed_by_key" {
+				return &ErrDocumentVersionSignatureAlreadyExists{
+					message: fmt.Sprintf("document version signature with document_version_id %s and signed_by %s already exists", pvs.DocumentVersionID, pvs.SignedBy),
+				}
+			}
+		}
 		return fmt.Errorf("cannot insert document version signature: %w", err)
 	}
 
diff --git a/pkg/coredata/evidence.go b/pkg/coredata/evidence.go
index 6f65dd34c..bf5c16622 100644
--- a/pkg/coredata/evidence.go
+++ b/pkg/coredata/evidence.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -42,8 +44,24 @@ type (
 	}
 
 	Evidences []*Evidence
+
+	ErrEvidenceNotFound struct {
+		Identifier string
+	}
+
+	ErrEvidenceAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrEvidenceNotFound) Error() string {
+	return fmt.Sprintf("evidence not found: %q", e.Identifier)
+}
+
+func (e ErrEvidenceAlreadyExists) Error() string {
+	return e.message
+}
+
 func (e Evidence) CursorKey(orderBy EvidenceOrderField) page.CursorKey {
 	switch orderBy {
 	case EvidenceOrderFieldCreatedAt:
@@ -165,7 +183,20 @@ VALUES (
 		"description":      e.Description,
 	}
 	_, err := conn.Exec(ctx, q, args)
-	return err
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "evidences_reference_id_key" {
+				return &ErrEvidenceAlreadyExists{
+					message: fmt.Sprintf("evidence with task_id %s and reference_id %q already exists", e.TaskID, e.ReferenceID),
+				}
+			}
+		}
+		return fmt.Errorf("cannot insert evidence: %w", err)
+	}
+
+	return nil
 }
 
 func (e *Evidence) LoadByID(
diff --git a/pkg/coredata/file.go b/pkg/coredata/file.go
index b8a519b25..bc6cf4641 100644
--- a/pkg/coredata/file.go
+++ b/pkg/coredata/file.go
@@ -16,12 +16,14 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
 
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -39,8 +41,24 @@ type (
 	}
 
 	Files []*File
+
+	ErrFileNotFound struct {
+		Identifier string
+	}
+
+	ErrFileAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrFileNotFound) Error() string {
+	return fmt.Sprintf("file not found: %q", e.Identifier)
+}
+
+func (e ErrFileAlreadyExists) Error() string {
+	return e.message
+}
+
 func (f *File) LoadByID(
 	ctx context.Context,
 	conn pg.Conn,
@@ -79,6 +97,10 @@ LIMIT 1;
 
 	file, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[File])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrFileNotFound{Identifier: fileID.String()}
+		}
+
 		return fmt.Errorf("cannot collect file: %w", err)
 	}
 
@@ -133,7 +155,20 @@ VALUES (
 		"deleted_at":  f.DeletedAt,
 	}
 	_, err := conn.Exec(ctx, q, args)
-	return err
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "files_file_key_key" {
+				return &ErrFileAlreadyExists{
+					message: fmt.Sprintf("file with file_key %q already exists", f.FileKey),
+				}
+			}
+		}
+		return fmt.Errorf("cannot insert file: %w", err)
+	}
+
+	return nil
 }
 
 func (f File) SoftDelete(ctx context.Context, conn pg.Conn, scope Scoper) error {
diff --git a/pkg/coredata/framework.go b/pkg/coredata/framework.go
index f2b16e102..ab5418c2a 100644
--- a/pkg/coredata/framework.go
+++ b/pkg/coredata/framework.go
@@ -41,12 +41,28 @@ type (
 
 	Frameworks []*Framework
 
+	ErrFrameworkNotFound struct {
+		Identifier string
+	}
+
+	ErrFrameworkAlreadyExists struct {
+		message string
+	}
+
 	ErrFrameworkReferenceIDAlreadyExists struct {
 		ReferenceID    string
 		OrganizationID gid.GID
 	}
 )
 
+func (e ErrFrameworkNotFound) Error() string {
+	return fmt.Sprintf("framework not found: %q", e.Identifier)
+}
+
+func (e ErrFrameworkAlreadyExists) Error() string {
+	return e.message
+}
+
 func (e ErrFrameworkReferenceIDAlreadyExists) Error() string {
 	return fmt.Sprintf("framework with reference ID %q already exists for organization %s", e.ReferenceID, e.OrganizationID)
 }
@@ -169,6 +185,10 @@ LIMIT 1;
 
 	framework, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Framework])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrFrameworkNotFound{Identifier: referenceID}
+		}
+
 		return fmt.Errorf("cannot collect framework: %w", err)
 	}
 
@@ -211,6 +231,10 @@ LIMIT 1;
 
 	framework, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Framework])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrFrameworkNotFound{Identifier: frameworkID.String()}
+		}
+
 		return fmt.Errorf("cannot collect framework: %w", err)
 	}
 
@@ -311,7 +335,7 @@ SET
   name = @name,
   description = @description,
   updated_at = @updated_at
-WHERE 
+WHERE
   %s
   AND id = @framework_id
 `
diff --git a/pkg/coredata/measure.go b/pkg/coredata/measure.go
index 67c81a23b..edcae2d5d 100644
--- a/pkg/coredata/measure.go
+++ b/pkg/coredata/measure.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 
 	"go.gearno.de/kit/pg"
 )
@@ -41,8 +43,24 @@ type (
 	}
 
 	Measures []*Measure
+
+	ErrMeasureNotFound struct {
+		Identifier string
+	}
+
+	ErrMeasureAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrMeasureNotFound) Error() string {
+	return fmt.Sprintf("measure not found: %q", e.Identifier)
+}
+
+func (e ErrMeasureAlreadyExists) Error() string {
+	return e.message
+}
+
 func (m Measure) CursorKey(orderBy MeasureOrderField) page.CursorKey {
 	switch orderBy {
 	case MeasureOrderFieldCreatedAt:
@@ -395,6 +413,10 @@ LIMIT 1;
 
 	measure, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Measure])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrMeasureNotFound{Identifier: measureID.String()}
+		}
+
 		return fmt.Errorf("cannot collect measures: %w", err)
 	}
 
@@ -525,7 +547,20 @@ VALUES (
 		"state":           m.State,
 	}
 	_, err := conn.Exec(ctx, q, args)
-	return err
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "mitigations_org_ref_unique" {
+				return &ErrMeasureAlreadyExists{
+					message: fmt.Sprintf("measure with organization_id %s and reference_id %q already exists", m.OrganizationID, m.ReferenceID),
+				}
+			}
+		}
+		return fmt.Errorf("cannot insert measure: %w", err)
+	}
+
+	return nil
 }
 
 func (m *Measure) Update(
diff --git a/pkg/coredata/organization.go b/pkg/coredata/organization.go
index a96eb910f..f58454b79 100644
--- a/pkg/coredata/organization.go
+++ b/pkg/coredata/organization.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -43,8 +44,24 @@ type (
 	}
 
 	Organizations []*Organization
+
+	ErrOrganizationNotFound struct {
+		Identifier string
+	}
+
+	ErrOrganizationAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrOrganizationNotFound) Error() string {
+	return fmt.Sprintf("organization not found: %q", e.Identifier)
+}
+
+func (e ErrOrganizationAlreadyExists) Error() string {
+	return e.message
+}
+
 func (o Organization) CursorKey(orderBy OrganizationOrderField) page.CursorKey {
 	switch orderBy {
 	case OrganizationOrderFieldName:
@@ -98,6 +115,10 @@ LIMIT 1;
 
 	organization, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Organization])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrOrganizationNotFound{Identifier: organizationID.String()}
+		}
+
 		return fmt.Errorf("cannot collect organization: %w", err)
 	}
 
@@ -372,6 +393,10 @@ LIMIT 1
 
 	organization, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Organization])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrOrganizationNotFound{Identifier: customDomainID.String()}
+		}
+
 		return fmt.Errorf("cannot collect organization: %w", err)
 	}
 
diff --git a/pkg/coredata/people.go b/pkg/coredata/people.go
index 6ee477f1f..3e0cff184 100644
--- a/pkg/coredata/people.go
+++ b/pkg/coredata/people.go
@@ -47,12 +47,20 @@ type (
 	ErrPeopleNotFound struct {
 		Identifier string
 	}
+
+	ErrPeopleAlreadyExists struct {
+		message string
+	}
 )
 
 func (e ErrPeopleNotFound) Error() string {
 	return fmt.Sprintf("people not found: %s", e.Identifier)
 }
 
+func (e ErrPeopleAlreadyExists) Error() string {
+	return e.message
+}
+
 func (p People) CursorKey(orderBy PeopleOrderField) page.CursorKey {
 	switch orderBy {
 	case PeopleOrderFieldCreatedAt:
@@ -105,6 +113,10 @@ LIMIT 1;
 
 	people, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[People])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrPeopleNotFound{Identifier: peopleID.String()}
+		}
+
 		return fmt.Errorf("cannot collect people: %w", err)
 	}
 
diff --git a/pkg/coredata/risk.go b/pkg/coredata/risk.go
index aae77790f..799e9c068 100644
--- a/pkg/coredata/risk.go
+++ b/pkg/coredata/risk.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -56,8 +57,24 @@ type (
 	RiskSnapshotter interface {
 		InsertRiskSnapshots(ctx context.Context, conn pg.Conn, scope Scoper, organizationID, snapshotID gid.GID) error
 	}
+
+	ErrRiskNotFound struct {
+		Identifier string
+	}
+
+	ErrRiskAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrRiskNotFound) Error() string {
+	return fmt.Sprintf("risk not found: %q", e.Identifier)
+}
+
+func (e ErrRiskAlreadyExists) Error() string {
+	return e.message
+}
+
 func (r *Risk) CursorKey(orderBy RiskOrderField) page.CursorKey {
 	switch orderBy {
 	case RiskOrderFieldCreatedAt:
@@ -374,6 +391,10 @@ LIMIT 1;
 
 	risk, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Risk])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrRiskNotFound{Identifier: riskID.String()}
+		}
+
 		return fmt.Errorf("cannot collect risk: %w", err)
 	}
 
diff --git a/pkg/coredata/session.go b/pkg/coredata/session.go
index 36e03ef04..cede4c38b 100644
--- a/pkg/coredata/session.go
+++ b/pkg/coredata/session.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"time"
 
@@ -35,32 +36,34 @@ type (
 		UpdatedAt time.Time   `db:"updated_at"`
 	}
 
-	// SessionData stores authentication context for a user session
-	// Stored as JSONB in database
 	SessionData struct {
-		// PasswordAuthenticated indicates if user authenticated with email/password
-		// Required for accessing organizations without SAML
-		PasswordAuthenticated bool `json:"password_authenticated"`
-
-		// SAMLAuthenticatedOrgs tracks which organizations user has SAML-authenticated for
-		// Key: organization ID as string, Value: SAML authentication info
-		// Required for accessing organizations with SAML enforcement
+		PasswordAuthenticated bool                   `json:"password_authenticated"`
 		SAMLAuthenticatedOrgs map[string]SAMLAuthInfo `json:"saml_authenticated_orgs,omitempty"`
 	}
 
-	// SAMLAuthInfo stores SAML authentication details for an organization
 	SAMLAuthInfo struct {
-		// AuthenticatedAt is when the user SAML-
 		AuthenticatedAt time.Time `json:"authenticated_at"`
+		SAMLConfigID    gid.GID   `json:"saml_config_id"`
+		SAMLSubject     string    `json:"saml_subject"`
+	}
 
-		// SAMLConfigID is the SAML configuration used for authentication
-		SAMLConfigID gid.GID `json:"saml_config_id"`
+	ErrSessionNotFound struct {
+		Identifier string
+	}
 
-		// SAMLSubject is the NameID from the SAML assertion (email address)
-		SAMLSubject string `json:"saml_subject"`
+	ErrSessionAlreadyExists struct {
+		message string
 	}
 )
 
+func (e ErrSessionNotFound) Error() string {
+	return fmt.Sprintf("session not found: %q", e.Identifier)
+}
+
+func (e ErrSessionAlreadyExists) Error() string {
+	return e.message
+}
+
 func (s Session) CursorKey(orderBy SessionOrderField) page.CursorKey {
 	switch orderBy {
 	case SessionOrderFieldCreatedAt:
@@ -99,6 +102,10 @@ LIMIT 1;
 
 	session, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Session])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrSessionNotFound{Identifier: sessionID.String()}
+		}
+
 		return fmt.Errorf("cannot collect session: %w", err)
 	}
 	*s = session
diff --git a/pkg/coredata/task.go b/pkg/coredata/task.go
index 08ccbce37..5530ec60d 100644
--- a/pkg/coredata/task.go
+++ b/pkg/coredata/task.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 
 	"go.gearno.de/kit/pg"
 )
@@ -44,8 +46,24 @@ type (
 	}
 
 	Tasks []*Task
+
+	ErrTaskNotFound struct {
+		Identifier string
+	}
+
+	ErrTaskAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrTaskNotFound) Error() string {
+	return fmt.Sprintf("task not found: %q", e.Identifier)
+}
+
+func (e ErrTaskAlreadyExists) Error() string {
+	return e.message
+}
+
 func (c Task) CursorKey(orderBy TaskOrderField) page.CursorKey {
 	switch orderBy {
 	case TaskOrderFieldCreatedAt:
@@ -95,6 +113,10 @@ LIMIT 1;
 
 	task, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Task])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrTaskNotFound{Identifier: taskID.String()}
+		}
+
 		return fmt.Errorf("cannot collect tasks: %w", err)
 	}
 
@@ -158,7 +180,20 @@ VALUES (
 		"updated_at":      c.UpdatedAt,
 	}
 	_, err := conn.Exec(ctx, q, args)
-	return err
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "tasks_reference_id_unique" {
+				return &ErrTaskAlreadyExists{
+					message: fmt.Sprintf("task with measure_id %s and reference_id %q already exists", c.MeasureID, c.ReferenceID),
+				}
+			}
+		}
+		return fmt.Errorf("cannot insert task: %w", err)
+	}
+
+	return nil
 }
 
 func (c *Task) Upsert(
diff --git a/pkg/coredata/trust_center.go b/pkg/coredata/trust_center.go
index 92c88fe3f..621d475e4 100644
--- a/pkg/coredata/trust_center.go
+++ b/pkg/coredata/trust_center.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -39,8 +41,24 @@ type (
 	}
 
 	TrustCenters []*TrustCenter
+
+	ErrTrustCenterNotFound struct {
+		Identifier string
+	}
+
+	ErrTrustCenterAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrTrustCenterNotFound) Error() string {
+	return fmt.Sprintf("trust center not found: %q", e.Identifier)
+}
+
+func (e ErrTrustCenterAlreadyExists) Error() string {
+	return e.message
+}
+
 func (tc *TrustCenter) CursorKey(orderBy TrustCenterOrderField) page.CursorKey {
 	switch orderBy {
 	case TrustCenterOrderFieldCreatedAt:
@@ -218,6 +236,14 @@ INSERT INTO trust_centers (
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "trust_centers_slug_key" {
+				return &ErrTrustCenterAlreadyExists{
+					message: fmt.Sprintf("trust center with slug %q already exists", tc.Slug),
+				}
+			}
+		}
 		return fmt.Errorf("cannot insert trust center: %w", err)
 	}
 
diff --git a/pkg/coredata/trust_center_access.go b/pkg/coredata/trust_center_access.go
index 3c2a3bb2d..c2cc649bd 100644
--- a/pkg/coredata/trust_center_access.go
+++ b/pkg/coredata/trust_center_access.go
@@ -25,6 +25,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -49,12 +50,20 @@ type (
 	ErrTrustCenterAccessNotFound struct {
 		Identifier string
 	}
+
+	ErrTrustCenterAccessAlreadyExists struct {
+		message string
+	}
 )
 
 func (e ErrTrustCenterAccessNotFound) Error() string {
 	return fmt.Sprintf("trust center access not found: %s", e.Identifier)
 }
 
+func (e ErrTrustCenterAccessAlreadyExists) Error() string {
+	return e.message
+}
+
 func (tca *TrustCenterAccess) CursorKey(orderBy TrustCenterAccessOrderField) page.CursorKey {
 	switch orderBy {
 	case TrustCenterAccessOrderFieldCreatedAt:
@@ -216,6 +225,14 @@ INSERT INTO trust_center_accesses (
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "trust_center_accesses_trust_center_id_email_key" {
+				return &ErrTrustCenterAccessAlreadyExists{
+					message: "trust center access already exists",
+				}
+			}
+		}
 		return fmt.Errorf("cannot insert trust center access: %w", err)
 	}
 
diff --git a/pkg/coredata/trust_center_document_access.go b/pkg/coredata/trust_center_document_access.go
index af72a3299..6bf7c0007 100644
--- a/pkg/coredata/trust_center_document_access.go
+++ b/pkg/coredata/trust_center_document_access.go
@@ -24,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -45,12 +46,20 @@ type (
 	ErrTrustCenterDocumentAccessNotFound struct {
 		Identifier string
 	}
+
+	ErrTrustCenterDocumentAccessAlreadyExists struct {
+		message string
+	}
 )
 
 func (e ErrTrustCenterDocumentAccessNotFound) Error() string {
 	return fmt.Sprintf("trust center document access not found: %s", e.Identifier)
 }
 
+func (e ErrTrustCenterDocumentAccessAlreadyExists) Error() string {
+	return e.message
+}
+
 func (tcda *TrustCenterDocumentAccess) CursorKey(orderBy TrustCenterDocumentAccessOrderField) page.CursorKey {
 	switch orderBy {
 	case TrustCenterDocumentAccessOrderFieldCreatedAt:
@@ -254,6 +263,25 @@ INSERT INTO trust_center_document_accesses (
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" {
+				switch pgErr.ConstraintName {
+				case "trust_center_document_accesse_trust_center_access_id_docume_key":
+					return &ErrTrustCenterDocumentAccessAlreadyExists{
+						message: fmt.Sprintf("trust center document access with trust_center_access_id %s and document_id %s already exists", tcda.TrustCenterAccessID, tcda.DocumentID),
+					}
+				case "trust_center_document_accesse_trust_center_access_id_report_key":
+					return &ErrTrustCenterDocumentAccessAlreadyExists{
+						message: fmt.Sprintf("trust center document access with trust_center_access_id %s and report_id %s already exists", tcda.TrustCenterAccessID, tcda.ReportID),
+					}
+				case "trust_center_document_accesses_trust_center_file_id_key":
+					return &ErrTrustCenterDocumentAccessAlreadyExists{
+						message: fmt.Sprintf("trust center document access with trust_center_access_id %s and trust_center_file_id %s already exists", tcda.TrustCenterAccessID, tcda.TrustCenterFileID),
+					}
+				}
+			}
+		}
 		return fmt.Errorf("cannot insert trust center document access: %w", err)
 	}
 
diff --git a/pkg/coredata/trust_center_reference.go b/pkg/coredata/trust_center_reference.go
index 124973d46..4854fcb24 100644
--- a/pkg/coredata/trust_center_reference.go
+++ b/pkg/coredata/trust_center_reference.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -42,12 +44,20 @@ type (
 	TrustCenterReferences []*TrustCenterReference
 
 	ErrTrustCenterReferenceNotFound struct {
-		ID string
+		Identifier string
+	}
+
+	ErrTrustCenterReferenceAlreadyExists struct {
+		message string
 	}
 )
 
 func (e ErrTrustCenterReferenceNotFound) Error() string {
-	return fmt.Sprintf("trust center reference not found: %s", e.ID)
+	return fmt.Sprintf("trust center reference not found: %q", e.Identifier)
+}
+
+func (e ErrTrustCenterReferenceAlreadyExists) Error() string {
+	return e.message
 }
 
 func (t TrustCenterReference) CursorKey(orderBy TrustCenterReferenceOrderField) page.CursorKey {
@@ -156,6 +166,14 @@ RETURNING rank;
 
 	err := conn.QueryRow(ctx, q, args).Scan(&t.Rank)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "trust_center_references_trust_center_id_rank_key" {
+				return &ErrTrustCenterReferenceAlreadyExists{
+					message: fmt.Sprintf("trust center reference with trust_center_id %s and rank already exists", t.TrustCenterID),
+				}
+			}
+		}
 		return fmt.Errorf("cannot insert trust center reference: %w", err)
 	}
 
@@ -198,7 +216,7 @@ WHERE
 	}
 
 	if result.RowsAffected() == 0 {
-		return ErrTrustCenterReferenceNotFound{ID: t.ID.String()}
+		return ErrTrustCenterReferenceNotFound{Identifier: t.ID.String()}
 	}
 
 	return nil
diff --git a/pkg/coredata/vendor.go b/pkg/coredata/vendor.go
index 030ad5942..94ff599fd 100644
--- a/pkg/coredata/vendor.go
+++ b/pkg/coredata/vendor.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -62,8 +63,24 @@ type (
 	VendorSnapshotter interface {
 		InsertVendorSnapshots(ctx context.Context, conn pg.Conn, scope Scoper, organizationID, snapshotID gid.GID) error
 	}
+
+	ErrVendorNotFound struct {
+		Identifier string
+	}
+
+	ErrVendorAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrVendorNotFound) Error() string {
+	return fmt.Sprintf("vendor not found: %q", e.Identifier)
+}
+
+func (e ErrVendorAlreadyExists) Error() string {
+	return e.message
+}
+
 func (v Vendor) CursorKey(orderBy VendorOrderField) page.CursorKey {
 	switch orderBy {
 	case VendorOrderFieldCreatedAt:
@@ -133,6 +150,10 @@ LIMIT 1;
 
 	vendor, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Vendor])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrVendorNotFound{Identifier: vendorID.String()}
+		}
+
 		return fmt.Errorf("cannot collect vendor: %w", err)
 	}
 
diff --git a/pkg/coredata/vendor_business_associate_agreement.go b/pkg/coredata/vendor_business_associate_agreement.go
index c872344a9..1c8d6e76e 100644
--- a/pkg/coredata/vendor_business_associate_agreement.go
+++ b/pkg/coredata/vendor_business_associate_agreement.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -41,8 +43,24 @@ type (
 	}
 
 	VendorBusinessAssociateAgreements []*VendorBusinessAssociateAgreement
+
+	ErrVendorBusinessAssociateAgreementNotFound struct {
+		Identifier string
+	}
+
+	ErrVendorBusinessAssociateAgreementAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrVendorBusinessAssociateAgreementNotFound) Error() string {
+	return fmt.Sprintf("vendor business associate agreement not found: %q", e.Identifier)
+}
+
+func (e ErrVendorBusinessAssociateAgreementAlreadyExists) Error() string {
+	return e.message
+}
+
 func (v VendorBusinessAssociateAgreement) CursorKey(orderBy VendorBusinessAssociateAgreementOrderField) page.CursorKey {
 	switch orderBy {
 	case VendorBusinessAssociateAgreementOrderFieldValidFrom:
@@ -241,7 +259,18 @@ ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
 	}
 
 	_, err := conn.Exec(ctx, q, args)
-	return err
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "vendor_business_associate_agreements_source_id_snapshot_id_key" {
+				return &ErrVendorBusinessAssociateAgreementAlreadyExists{
+					message: fmt.Sprintf("vendor business associate agreement with source_id %s and snapshot_id %s already exists", vbaa.SourceID, vbaa.SnapshotID),
+				}
+			}
+		}
+		return fmt.Errorf("cannot upsert vendor business associate agreement: %w", err)
+	}
+	return nil
 }
 
 func (vbaa *VendorBusinessAssociateAgreement) Delete(
diff --git a/pkg/coredata/vendor_data_privacy_agreement.go b/pkg/coredata/vendor_data_privacy_agreement.go
index 3736a1ed1..95bd3f06b 100644
--- a/pkg/coredata/vendor_data_privacy_agreement.go
+++ b/pkg/coredata/vendor_data_privacy_agreement.go
@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -41,8 +43,24 @@ type (
 	}
 
 	VendorDataPrivacyAgreements []*VendorDataPrivacyAgreement
+
+	ErrVendorDataPrivacyAgreementNotFound struct {
+		Identifier string
+	}
+
+	ErrVendorDataPrivacyAgreementAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrVendorDataPrivacyAgreementNotFound) Error() string {
+	return fmt.Sprintf("vendor data privacy agreement not found: %q", e.Identifier)
+}
+
+func (e ErrVendorDataPrivacyAgreementAlreadyExists) Error() string {
+	return e.message
+}
+
 func (v VendorDataPrivacyAgreement) CursorKey(orderBy VendorDataPrivacyAgreementOrderField) page.CursorKey {
 	switch orderBy {
 	case VendorDataPrivacyAgreementOrderFieldValidFrom:
@@ -241,7 +259,18 @@ ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
 	}
 
 	_, err := conn.Exec(ctx, q, args)
-	return err
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "vendor_data_privacy_agreements_source_id_snapshot_id_key" {
+				return &ErrVendorDataPrivacyAgreementAlreadyExists{
+					message: fmt.Sprintf("vendor data privacy agreement with source_id %s and snapshot_id %s already exists", vdpa.SourceID, vdpa.SnapshotID),
+				}
+			}
+		}
+		return fmt.Errorf("cannot upsert vendor data privacy agreement: %w", err)
+	}
+	return nil
 }
 
 func (vdpa *VendorDataPrivacyAgreement) Delete(
diff --git a/pkg/probo/document_service.go b/pkg/probo/document_service.go
index 4e17b03ed..01e3cf8b3 100644
--- a/pkg/probo/document_service.go
+++ b/pkg/probo/document_service.go
@@ -276,7 +276,9 @@ func (s *DocumentService) publishVersionInTx(
 		if publishedVersion.Content == documentVersion.Content &&
 			publishedVersion.Title == documentVersion.Title &&
 			publishedVersion.OwnerID == documentVersion.OwnerID {
-			return nil, nil, fmt.Errorf("cannot publish version: no changes detected")
+			return nil, nil, &coredata.ErrDocumentVersionNoChanges{
+				Message: "no changes detected",
+			}
 		}
 	}
 
diff --git a/pkg/server/api/console/v1/resolver.go b/pkg/server/api/console/v1/resolver.go
index b3fc8e5f9..bef4d04ab 100644
--- a/pkg/server/api/console/v1/resolver.go
+++ b/pkg/server/api/console/v1/resolver.go
@@ -441,7 +441,7 @@ func validateTenantAccess(ctx context.Context, tenantID gid.TenantID) {
 	access, _ := ctx.Value(userTenantContextKey).(*userTenantAccess)
 
 	if access == nil {
-		panic(fmt.Errorf("tenant not found"))
+		panic(&authz.TenantAccessError{Message: "tenant not found"})
 	}
 
 	if !slices.Contains(access.tenantIDs, tenantID) {
@@ -451,6 +451,6 @@ func validateTenantAccess(ctx context.Context, tenantID gid.TenantID) {
 			}
 		}
 
-		panic(fmt.Errorf("access denied to tenant"))
+		panic(&authz.TenantAccessError{Message: "tenant not found"})
 	}
 }
diff --git a/pkg/server/api/console/v1/v1_resolver.go b/pkg/server/api/console/v1/v1_resolver.go
index f1a1c28ee..bc3d3f1d5 100644
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -20,6 +20,7 @@ import (
 	"github.com/getprobo/probo/pkg/probo"
 	"github.com/getprobo/probo/pkg/server/api/console/v1/schema"
 	"github.com/getprobo/probo/pkg/server/api/console/v1/types"
+	"github.com/getprobo/probo/pkg/server/graphql"
 	pgx "github.com/jackc/pgx/v5"
 	"github.com/vektah/gqlparser/v2/gqlerror"
 )
@@ -30,11 +31,19 @@ func (r *assetResolver) Owner(ctx context.Context, obj *types.Asset) (*types.Peo
 
 	asset, err := prb.Assets.Get(ctx, obj.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrAssetNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get asset: %w", err))
 	}
 
 	owner, err := prb.Peoples.Get(ctx, asset.OwnerID)
 	if err != nil {
+		var errNotFound *coredata.ErrPeopleNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get owner: %w", err))
 	}
 
@@ -72,6 +81,10 @@ func (r *assetResolver) AssetType(ctx context.Context, obj *types.Asset) (coreda
 
 	asset, err := prb.Assets.Get(ctx, obj.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrAssetNotFound
+		if errors.As(err, &errNotFound) {
+			return "", errNotFound
+		}
 		panic(fmt.Errorf("cannot get asset: %w", err))
 	}
 
@@ -88,6 +101,10 @@ func (r *assetResolver) Organization(ctx context.Context, obj *types.Asset) (*ty
 
 	org, err := prb.Organizations.Get(ctx, obj.Organization.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get organization: %w", err))
 	}
 
@@ -121,11 +138,19 @@ func (r *auditResolver) Organization(ctx context.Context, obj *types.Audit) (*ty
 
 	audit, err := prb.Audits.Get(ctx, obj.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrAuditNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot load audit: %w", err))
 	}
 
 	organization, err := prb.Organizations.Get(ctx, audit.OrganizationID)
 	if err != nil {
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot load organization: %w", err))
 	}
 
@@ -138,11 +163,19 @@ func (r *auditResolver) Framework(ctx context.Context, obj *types.Audit) (*types
 
 	audit, err := prb.Audits.Get(ctx, obj.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrAuditNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot load audit: %w", err))
 	}
 
 	framework, err := prb.Frameworks.Get(ctx, audit.FrameworkID)
 	if err != nil {
+		var errNotFound *coredata.ErrFrameworkNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot load framework: %w", err))
 	}
 
@@ -155,6 +188,10 @@ func (r *auditResolver) Report(ctx context.Context, obj *types.Audit) (*types.Re
 
 	audit, err := prb.Audits.Get(ctx, obj.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrAuditNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot load audit: %w", err))
 	}
 
@@ -238,6 +275,10 @@ func (r *continualImprovementResolver) Organization(ctx context.Context, obj *ty
 
 	organization, err := prb.Organizations.Get(ctx, continualImprovement.OrganizationID)
 	if err != nil {
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get continual improvement organization: %w", err))
 	}
 
@@ -255,6 +296,10 @@ func (r *continualImprovementResolver) Owner(ctx context.Context, obj *types.Con
 
 	people, err := prb.Peoples.Get(ctx, continualImprovement.OwnerID)
 	if err != nil {
+		var errNotFound *coredata.ErrPeopleNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get continual improvement owner: %w", err))
 	}
 
@@ -288,11 +333,19 @@ func (r *controlResolver) Framework(ctx context.Context, obj *types.Control) (*t
 
 	control, err := prb.Controls.Get(ctx, obj.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrControlNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get control: %w", err))
 	}
 
 	framework, err := prb.Frameworks.Get(ctx, control.FrameworkID)
 	if err != nil {
+		var errNotFound *coredata.ErrFrameworkNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get framework: %w", err))
 	}
 
@@ -323,7 +376,7 @@ func (r *controlResolver) Measures(ctx context.Context, obj *types.Control, firs
 
 	page, err := prb.Measures.ListForControlID(ctx, obj.ID, cursor, measureFilter)
 	if err != nil {
-		return nil, fmt.Errorf("cannot list measures: %w", err)
+		panic(fmt.Errorf("cannot list measures: %w", err))
 	}
 
 	return types.NewMeasureConnection(page, r, obj.ID, measureFilter), nil
@@ -353,7 +406,7 @@ func (r *controlResolver) Documents(ctx context.Context, obj *types.Control, fir
 
 	page, err := prb.Documents.ListForControlID(ctx, obj.ID, cursor, documentFilter)
 	if err != nil {
-		return nil, fmt.Errorf("cannot list documents: %w", err)
+		panic(fmt.Errorf("cannot list documents: %w", err))
 	}
 
 	return types.NewDocumentConnection(page, r, obj.ID, documentFilter), nil
@@ -378,7 +431,7 @@ func (r *controlResolver) Audits(ctx context.Context, obj *types.Control, first
 
 	page, err := prb.Audits.ListForControlID(ctx, obj.ID, cursor)
 	if err != nil {
-		return nil, fmt.Errorf("cannot list control audits: %w", err)
+		panic(fmt.Errorf("cannot list control audits: %w", err))
 	}
 
 	return types.NewAuditConnection(page, r, obj.ID), nil
@@ -418,31 +471,31 @@ func (r *controlConnectionResolver) TotalCount(ctx context.Context, obj *types.C
 	case *organizationResolver:
 		count, err := prb.Controls.CountForOrganizationID(ctx, obj.ParentID, obj.Filters)
 		if err != nil {
-			return 0, fmt.Errorf("cannot count controls: %w", err)
+			panic(fmt.Errorf("cannot count controls: %w", err))
 		}
 		return count, nil
 	case *frameworkResolver:
 		count, err := prb.Controls.CountForFrameworkID(ctx, obj.ParentID, obj.Filters)
 		if err != nil {
-			return 0, fmt.Errorf("cannot count controls: %w", err)
+			panic(fmt.Errorf("cannot count controls: %w", err))
 		}
 		return count, nil
 	case *documentResolver:
 		count, err := prb.Controls.CountForDocumentID(ctx, obj.ParentID, obj.Filters)
 		if err != nil {
-			return 0, fmt.Errorf("cannot count controls: %w", err)
+			panic(fmt.Errorf("cannot count controls: %w", err))
 		}
 		return count, nil
 	case *measureResolver:
 		count, err := prb.Controls.CountForMeasureID(ctx, obj.ParentID, obj.Filters)
 		if err != nil {
-			return 0, fmt.Errorf("cannot count controls: %w", err)
+			panic(fmt.Errorf("cannot count controls: %w", err))
 		}
 		return count, nil
 	case *riskResolver:
 		count, err := prb.Controls.CountForRiskID(ctx, obj.ParentID, obj.Filters)
 		if err != nil {
-			return 0, fmt.Errorf("cannot count controls: %w", err)
+			panic(fmt.Errorf("cannot count controls: %w", err))
 		}
 		return count, nil
 	}
@@ -461,6 +514,10 @@ func (r *datumResolver) Owner(ctx context.Context, obj *types.Datum) (*types.Peo
 
 	people, err := prb.Peoples.Get(ctx, data.OwnerID)
 	if err != nil {
+		var errNotFound *coredata.ErrPeopleNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		return nil, fmt.Errorf("cannot get owner: %w", err)
 	}
 
@@ -498,7 +555,11 @@ func (r *datumResolver) Organization(ctx context.Context, obj *types.Datum) (*ty
 
 	org, err := prb.Organizations.Get(ctx, obj.Organization.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get organization: %w", err)
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot get organization: %w", err))
 	}
 
 	return types.NewOrganization(org), nil
@@ -517,7 +578,7 @@ func (r *datumConnectionResolver) TotalCount(ctx context.Context, obj *types.Dat
 
 		count, err := prb.Data.CountForOrganizationID(ctx, obj.ParentID, datumFilter)
 		if err != nil {
-			return 0, fmt.Errorf("cannot count data: %w", err)
+			panic(fmt.Errorf("cannot count data: %w", err))
 		}
 		return count, nil
 	}
@@ -531,12 +592,20 @@ func (r *documentResolver) Owner(ctx context.Context, obj *types.Document) (*typ
 
 	document, err := prb.Documents.Get(ctx, obj.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrDocumentNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get document: %w", err))
 	}
 
 	// Get the owner
 	owner, err := prb.Peoples.Get(ctx, document.OwnerID)
 	if err != nil {
+		var errNotFound *coredata.ErrPeopleNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get owner: %w", err))
 	}
 
@@ -549,11 +618,19 @@ func (r *documentResolver) Organization(ctx context.Context, obj *types.Document
 
 	document, err := prb.Documents.Get(ctx, obj.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrDocumentNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get document: %w", err))
 	}
 
 	organization, err := prb.Organizations.Get(ctx, document.OrganizationID)
 	if err != nil {
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get organization: %w", err))
 	}
 
@@ -654,6 +731,10 @@ func (r *documentVersionResolver) Document(ctx context.Context, obj *types.Docum
 
 	document, err := prb.Documents.Get(ctx, documentVersion.DocumentID)
 	if err != nil {
+		var errNotFound *coredata.ErrDocumentNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get document: %w", err))
 	}
 
@@ -671,6 +752,10 @@ func (r *documentVersionResolver) Owner(ctx context.Context, obj *types.Document
 
 	owner, err := prb.Peoples.Get(ctx, documentVersion.OwnerID)
 	if err != nil {
+		var errNotFound *coredata.ErrPeopleNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get owner: %w", err))
 	}
 
@@ -736,6 +821,10 @@ func (r *documentVersionSignatureResolver) SignedBy(ctx context.Context, obj *ty
 
 	people, err := prb.Peoples.Get(ctx, documentVersionSignature.SignedBy)
 	if err != nil {
+		var errNotFound *coredata.ErrPeopleNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get people: %w", err))
 	}
 
@@ -748,7 +837,7 @@ func (r *evidenceResolver) File(ctx context.Context, obj *types.Evidence) (*type
 
 	evidence, err := prb.Evidences.Get(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot load evidence: %w", err)
+		panic(fmt.Errorf("cannot load evidence: %w", err))
 	}
 
 	if evidence.EvidenceFileId == nil {
@@ -757,7 +846,11 @@ func (r *evidenceResolver) File(ctx context.Context, obj *types.Evidence) (*type
 
 	file, err := prb.Files.Get(ctx, *evidence.EvidenceFileId)
 	if err != nil {
-		return nil, fmt.Errorf("cannot load evidence file: %w", err)
+		var errNotFound *coredata.ErrFileNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot load evidence file: %w", err))
 	}
 
 	return types.NewFile(file), nil
@@ -769,16 +862,20 @@ func (r *evidenceResolver) Task(ctx context.Context, obj *types.Evidence) (*type
 
 	evidence, err := prb.Evidences.Get(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot load evidence: %w", err)
+		panic(fmt.Errorf("cannot load evidence: %w", err))
 	}
 
 	if evidence.TaskID == nil {
-		return nil, fmt.Errorf("evidence is not associated with a task")
+		panic(fmt.Errorf("evidence is not associated with a task"))
 	}
 
 	task, err := prb.Tasks.Get(ctx, *evidence.TaskID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot load task: %w", err)
+		var errNotFound *coredata.ErrTaskNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot load task: %w", err))
 	}
 
 	return types.NewTask(task), nil
@@ -790,12 +887,16 @@ func (r *evidenceResolver) Measure(ctx context.Context, obj *types.Evidence) (*t
 
 	evidence, err := prb.Evidences.Get(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot load evidence: %w", err)
+		panic(fmt.Errorf("cannot load evidence: %w", err))
 	}
 
 	measure, err := prb.Measures.Get(ctx, evidence.MeasureID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot load measure: %w", err)
+		var errNotFound *coredata.ErrMeasureNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot load measure: %w", err))
 	}
 
 	return types.NewMeasure(measure), nil
@@ -809,13 +910,13 @@ func (r *evidenceConnectionResolver) TotalCount(ctx context.Context, obj *types.
 	case *measureResolver:
 		count, err := prb.Evidences.CountForMeasureID(ctx, obj.ParentID)
 		if err != nil {
-			return 0, fmt.Errorf("cannot count tasks: %w", err)
+			panic(fmt.Errorf("cannot count tasks: %w", err))
 		}
 		return count, nil
 	case *taskResolver:
 		count, err := prb.Evidences.CountForTaskID(ctx, obj.ParentID)
 		if err != nil {
-			return 0, fmt.Errorf("cannot count tasks: %w", err)
+			panic(fmt.Errorf("cannot count tasks: %w", err))
 		}
 		return count, nil
 	}
@@ -841,12 +942,20 @@ func (r *frameworkResolver) Organization(ctx context.Context, obj *types.Framewo
 
 	framework, err := prb.Frameworks.Get(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot load framework: %w", err)
+		var errNotFound *coredata.ErrFrameworkNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot load framework: %w", err))
 	}
 
 	organization, err := prb.Organizations.Get(ctx, framework.OrganizationID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot load organization: %w", err)
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot load organization: %w", err))
 	}
 
 	return types.NewOrganization(organization), nil
@@ -876,7 +985,7 @@ func (r *frameworkResolver) Controls(ctx context.Context, obj *types.Framework,
 
 	page, err := prb.Controls.ListForFrameworkID(ctx, obj.ID, cursor, controlFilter)
 	if err != nil {
-		return nil, fmt.Errorf("cannot list controls: %w", err)
+		panic(fmt.Errorf("cannot list controls: %w", err))
 	}
 
 	return types.NewControlConnection(page, r, obj.ID, controlFilter), nil
@@ -890,7 +999,7 @@ func (r *frameworkConnectionResolver) TotalCount(ctx context.Context, obj *types
 	case *organizationResolver:
 		count, err := prb.Frameworks.CountForOrganizationID(ctx, obj.ParentID)
 		if err != nil {
-			return 0, fmt.Errorf("cannot count frameworks: %w", err)
+			panic(fmt.Errorf("cannot count frameworks: %w", err))
 		}
 		return count, nil
 	}
@@ -949,7 +1058,7 @@ func (r *measureResolver) Evidences(ctx context.Context, obj *types.Measure, fir
 
 	page, err := prb.Evidences.ListForMeasureID(ctx, obj.ID, cursor)
 	if err != nil {
-		return nil, fmt.Errorf("cannot list measure evidences: %w", err)
+		panic(fmt.Errorf("cannot list measure evidences: %w", err))
 	}
 
 	return types.NewEvidenceConnection(page, r, obj.ID), nil
@@ -974,7 +1083,7 @@ func (r *measureResolver) Tasks(ctx context.Context, obj *types.Measure, first *
 
 	page, err := prb.Tasks.ListForMeasureID(ctx, obj.ID, cursor)
 	if err != nil {
-		return nil, fmt.Errorf("cannot list measure tasks: %w", err)
+		panic(fmt.Errorf("cannot list measure tasks: %w", err))
 	}
 
 	return types.NewTaskConnection(page, r, obj.ID), nil
@@ -1004,7 +1113,7 @@ func (r *measureResolver) Risks(ctx context.Context, obj *types.Measure, first *
 
 	page, err := prb.Risks.ListForMeasureID(ctx, obj.ID, cursor, riskFilter)
 	if err != nil {
-		return nil, fmt.Errorf("cannot list measure risks: %w", err)
+		panic(fmt.Errorf("cannot list measure risks: %w", err))
 	}
 
 	return types.NewRiskConnection(page, r, obj.ID, riskFilter), nil
@@ -1034,7 +1143,7 @@ func (r *measureResolver) Controls(ctx context.Context, obj *types.Measure, firs
 
 	page, err := prb.Controls.ListForMeasureID(ctx, obj.ID, cursor, controlFilter)
 	if err != nil {
-		return nil, fmt.Errorf("cannot list measure controls: %w", err)
+		panic(fmt.Errorf("cannot list measure controls: %w", err))
 	}
 
 	return types.NewControlConnection(page, r, obj.ID, controlFilter), nil
@@ -1048,19 +1157,19 @@ func (r *measureConnectionResolver) TotalCount(ctx context.Context, obj *types.M
 	case *organizationResolver:
 		count, err := prb.Measures.CountForOrganizationID(ctx, obj.ParentID, obj.Filters)
 		if err != nil {
-			return 0, fmt.Errorf("cannot count measures: %w", err)
+			panic(fmt.Errorf("cannot count measures: %w", err))
 		}
 		return count, nil
 	case *controlResolver:
 		count, err := prb.Measures.CountForControlID(ctx, obj.ParentID, obj.Filters)
 		if err != nil {
-			return 0, fmt.Errorf("cannot count measures: %w", err)
+			panic(fmt.Errorf("cannot count measures: %w", err))
 		}
 		return count, nil
 	case *riskResolver:
 		count, err := prb.Measures.CountForRiskID(ctx, obj.ParentID, obj.Filters)
 		if err != nil {
-			return 0, fmt.Errorf("cannot count measures: %w", err)
+			panic(fmt.Errorf("cannot count measures: %w", err))
 		}
 		return count, nil
 	}
@@ -1116,7 +1225,15 @@ func (r *mutationResolver) CreateOrganization(ctx context.Context, input types.C
 		},
 	)
 	if err != nil {
-		return nil, fmt.Errorf("cannot create organization: %w", err)
+		var errAlreadyExists *coredata.ErrOrganizationAlreadyExists
+		if errors.As(err, &errAlreadyExists) {
+			return nil, graphql.Conflict(errAlreadyExists)
+		}
+		var errTrustCenterAlreadyExists *coredata.ErrTrustCenterAlreadyExists
+		if errors.As(err, &errTrustCenterAlreadyExists) {
+			return nil, graphql.Conflict(errTrustCenterAlreadyExists)
+		}
+		panic(fmt.Errorf("cannot create organization: %w", err))
 	}
 
 	err = authz.AddUserToOrganization(
@@ -1126,7 +1243,7 @@ func (r *mutationResolver) CreateOrganization(ctx context.Context, input types.C
 		coredata.RoleMember,
 	)
 	if err != nil {
-		return nil, fmt.Errorf("cannot add user to organization: %w", err)
+		panic(fmt.Errorf("cannot add user to organization: %w", err))
 	}
 
 	_, err = prb.Peoples.Create(
@@ -1141,7 +1258,11 @@ func (r *mutationResolver) CreateOrganization(ctx context.Context, input types.C
 	)
 
 	if err != nil {
-		return nil, fmt.Errorf("cannot create people: %w", err)
+		var errAlreadyExists *coredata.ErrPeopleAlreadyExists
+		if errors.As(err, &errAlreadyExists) {
+			return nil, graphql.Conflict(errAlreadyExists)
+		}
+		panic(fmt.Errorf("cannot create people: %w", err))
 	}
 
 	// Append tenant to allowed one
@@ -1202,7 +1323,7 @@ func (r *mutationResolver) DeleteOrganizationHorizontalLogo(ctx context.Context,
 
 	organization, err := prb.Organizations.DeleteHorizontalLogo(ctx, input.OrganizationID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete horizontal logo: %w", err)
+		panic(fmt.Errorf("cannot delete horizontal logo: %w", err))
 	}
 
 	return &types.DeleteOrganizationHorizontalLogoPayload{
@@ -1216,7 +1337,7 @@ func (r *mutationResolver) DeleteOrganization(ctx context.Context, input types.D
 
 	err := prb.Organizations.Delete(ctx, input.OrganizationID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete organization: %w", err)
+		panic(fmt.Errorf("cannot delete organization: %w", err))
 	}
 
 	return &types.DeleteOrganizationPayload{
@@ -1233,7 +1354,7 @@ func (r *mutationResolver) UpdateTrustCenter(ctx context.Context, input types.Up
 		Active: input.Active,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot update trust center: %w", err)
+		panic(fmt.Errorf("cannot update trust center: %w", err))
 	}
 
 	return &types.UpdateTrustCenterPayload{
@@ -1251,7 +1372,7 @@ func (r *mutationResolver) UploadTrustCenterNda(ctx context.Context, input types
 		FileName:      input.FileName,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot upload trust center NDA: %w", err)
+		panic(fmt.Errorf("cannot upload trust center NDA: %w", err))
 	}
 
 	return &types.UploadTrustCenterNDAPayload{
@@ -1267,7 +1388,7 @@ func (r *mutationResolver) DeleteTrustCenterNda(ctx context.Context, input types
 		TrustCenterID: input.TrustCenterID,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete trust center NDA: %w", err)
+		panic(fmt.Errorf("cannot delete trust center NDA: %w", err))
 	}
 
 	return &types.DeleteTrustCenterNDAPayload{
@@ -1285,7 +1406,11 @@ func (r *mutationResolver) CreateTrustCenterAccess(ctx context.Context, input ty
 		Name:          input.Name,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot create trust center access: %w", err)
+		var errAlreadyExists *coredata.ErrTrustCenterAccessAlreadyExists
+		if errors.As(err, &errAlreadyExists) {
+			return nil, graphql.Conflict(errAlreadyExists)
+		}
+		panic(fmt.Errorf("cannot create trust center access: %w", err))
 	}
 
 	return &types.CreateTrustCenterAccessPayload{
@@ -1322,7 +1447,7 @@ func (r *mutationResolver) DeleteTrustCenterAccess(ctx context.Context, input ty
 		ID: input.ID,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete trust center access: %w", err)
+		panic(fmt.Errorf("cannot delete trust center access: %w", err))
 	}
 
 	return &types.DeleteTrustCenterAccessPayload{
@@ -1347,7 +1472,7 @@ func (r *mutationResolver) CreateTrustCenterReference(ctx context.Context, input
 		},
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot create trust center reference: %w", err)
+		panic(fmt.Errorf("cannot create trust center reference: %w", err))
 	}
 
 	return &types.CreateTrustCenterReferencePayload{
@@ -1378,7 +1503,7 @@ func (r *mutationResolver) UpdateTrustCenterReference(ctx context.Context, input
 
 	reference, err := prb.TrustCenterReferences.Update(ctx, req)
 	if err != nil {
-		return nil, fmt.Errorf("cannot update trust center reference: %w", err)
+		panic(fmt.Errorf("cannot update trust center reference: %w", err))
 	}
 
 	return &types.UpdateTrustCenterReferencePayload{
@@ -1394,7 +1519,7 @@ func (r *mutationResolver) DeleteTrustCenterReference(ctx context.Context, input
 		ID: input.ID,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete trust center reference: %w", err)
+		panic(fmt.Errorf("cannot delete trust center reference: %w", err))
 	}
 
 	return &types.DeleteTrustCenterReferencePayload{
@@ -1419,7 +1544,7 @@ func (r *mutationResolver) CreateTrustCenterFile(ctx context.Context, input type
 		TrustCenterVisibility: input.TrustCenterVisibility,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot create trust center file: %w", err)
+		panic(fmt.Errorf("cannot create trust center file: %w", err))
 	}
 
 	return &types.CreateTrustCenterFilePayload{
@@ -1438,7 +1563,7 @@ func (r *mutationResolver) UpdateTrustCenterFile(ctx context.Context, input type
 		TrustCenterVisibility: input.TrustCenterVisibility,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot update trust center file: %w", err)
+		panic(fmt.Errorf("cannot update trust center file: %w", err))
 	}
 
 	return &types.UpdateTrustCenterFilePayload{
@@ -1452,7 +1577,7 @@ func (r *mutationResolver) GetTrustCenterFile(ctx context.Context, input types.G
 
 	file, err := prb.TrustCenterFiles.Get(ctx, input.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get trust center file: %w", err)
+		panic(fmt.Errorf("cannot get trust center file: %w", err))
 	}
 
 	return &types.GetTrustCenterFilePayload{
@@ -1468,7 +1593,7 @@ func (r *mutationResolver) DeleteTrustCenterFile(ctx context.Context, input type
 		ID: input.ID,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete trust center file: %w", err)
+		panic(fmt.Errorf("cannot delete trust center file: %w", err))
 	}
 
 	return &types.DeleteTrustCenterFilePayload{
@@ -1505,7 +1630,11 @@ func (r *mutationResolver) InviteUser(ctx context.Context, input types.InviteUse
 			Kind:                     coredata.PeopleKindEmployee,
 		})
 		if err != nil {
-			return nil, fmt.Errorf("cannot create people record: %w", err)
+			var errAlreadyExists *coredata.ErrPeopleAlreadyExists
+			if errors.As(err, &errAlreadyExists) {
+				return nil, graphql.Conflict(errAlreadyExists)
+			}
+			return nil, fmt.Errorf("failed to create people record: %w", err)
 		}
 	}
 
@@ -1566,7 +1695,11 @@ func (r *mutationResolver) CreatePeople(ctx context.Context, input types.CreateP
 	})
 
 	if err != nil {
-		return nil, fmt.Errorf("cannot create people: %w", err)
+		var errAlreadyExists *coredata.ErrPeopleAlreadyExists
+		if errors.As(err, &errAlreadyExists) {
+			return nil, graphql.Conflict(errAlreadyExists)
+		}
+		panic(fmt.Errorf("cannot create people: %w", err))
 	}
 
 	return &types.CreatePeoplePayload{
@@ -1589,7 +1722,7 @@ func (r *mutationResolver) UpdatePeople(ctx context.Context, input types.UpdateP
 		ContractEndDate:          UnwrapOmittable(input.ContractEndDate),
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot update people: %w", err)
+		panic(fmt.Errorf("cannot update people: %w", err))
 	}
 
 	return &types.UpdatePeoplePayload{
@@ -1603,7 +1736,7 @@ func (r *mutationResolver) DeletePeople(ctx context.Context, input types.DeleteP
 
 	err := prb.Peoples.Delete(ctx, input.PeopleID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete people: %w", err)
+		panic(fmt.Errorf("cannot delete people: %w", err))
 	}
 
 	return &types.DeletePeoplePayload{
@@ -1641,6 +1774,10 @@ func (r *mutationResolver) CreateVendor(ctx context.Context, input types.CreateV
 		},
 	)
 	if err != nil {
+		var errAlreadyExists *coredata.ErrVendorAlreadyExists
+		if errors.As(err, &errAlreadyExists) {
+			return nil, graphql.Conflict(errAlreadyExists)
+		}
 		return nil, fmt.Errorf("cannot create vendor: %w", err)
 	}
 	return &types.CreateVendorPayload{
@@ -1690,7 +1827,7 @@ func (r *mutationResolver) DeleteVendor(ctx context.Context, input types.DeleteV
 
 	err := prb.Vendors.Delete(ctx, input.VendorID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete vendor: %w", err)
+		panic(fmt.Errorf("cannot delete vendor: %w", err))
 	}
 
 	return &types.DeleteVendorPayload{
@@ -1734,7 +1871,7 @@ func (r *mutationResolver) UpdateVendorContact(ctx context.Context, input types.
 
 	vendorContact, err := prb.VendorContacts.Update(ctx, req)
 	if err != nil {
-		return nil, fmt.Errorf("cannot update vendor contact: %w", err)
+		panic(fmt.Errorf("failed to update vendor contact: %w", err))
 	}
 
 	return &types.UpdateVendorContactPayload{
@@ -1788,7 +1925,7 @@ func (r *mutationResolver) UpdateVendorService(ctx context.Context, input types.
 
 	vendorService, err := prb.VendorServices.Update(ctx, req)
 	if err != nil {
-		return nil, fmt.Errorf("cannot update vendor service: %w", err)
+		panic(fmt.Errorf("failed to update vendor service: %w", err))
 	}
 
 	return &types.UpdateVendorServicePayload{
@@ -1802,7 +1939,7 @@ func (r *mutationResolver) DeleteVendorService(ctx context.Context, input types.
 
 	err := prb.VendorServices.Delete(ctx, input.VendorServiceID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete vendor service: %w", err)
+		panic(fmt.Errorf("failed to delete vendor service: %w", err))
 	}
 
 	return &types.DeleteVendorServicePayload{
@@ -1851,7 +1988,7 @@ func (r *mutationResolver) ImportFramework(ctx context.Context, input types.Impo
 
 	req := probo.ImportFrameworkRequest{}
 	if err := json.NewDecoder(input.File.File).Decode(&req.Framework); err != nil {
-		return nil, fmt.Errorf("cannot decode framework: %w", err)
+		panic(fmt.Errorf("cannot decode framework: %w", err))
 	}
 
 	framework, err := prb.Frameworks.Import(ctx, input.OrganizationID, req)
@@ -1862,12 +1999,13 @@ func (r *mutationResolver) ImportFramework(ctx context.Context, input types.Impo
 				Err:     err,
 				Message: fmt.Sprintf("framework %q already exists", req.Framework.Name),
 				Extensions: map[string]any{
+					"code":                 "CONFLICT",
 					"frameworkReferenceId": errFrameworkReferenceIDAlreadyExists.ReferenceID,
 				},
 			}
 		}
 
-		return nil, fmt.Errorf("cannot import framework: %w", err)
+		panic(fmt.Errorf("cannot import framework: %w", err))
 	}
 
 	return &types.ImportFrameworkPayload{
@@ -1881,7 +2019,7 @@ func (r *mutationResolver) DeleteFramework(ctx context.Context, input types.Dele
 
 	err := prb.Frameworks.Delete(ctx, input.FrameworkID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete framework: %w", err)
+		panic(fmt.Errorf("cannot delete framework: %w", err))
 	}
 
 	return &types.DeleteFrameworkPayload{
@@ -1895,7 +2033,7 @@ func (r *mutationResolver) GenerateFrameworkStateOfApplicability(ctx context.Con
 
 	soa, err := prb.Frameworks.StateOfApplicability(ctx, input.FrameworkID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot generate framework SOA: %w", err)
+		panic(fmt.Errorf("cannot generate framework SOA: %w", err))
 	}
 
 	return &types.GenerateFrameworkStateOfApplicabilityPayload{
@@ -1918,7 +2056,7 @@ func (r *mutationResolver) ExportFramework(ctx context.Context, input types.Expo
 		user.FullName,
 	)
 	if err != nil {
-		return nil, fmt.Errorf("cannot export framework: %w", err)
+		panic(fmt.Errorf("cannot export framework: %w", err))
 	}
 
 	return &types.ExportFrameworkPayload{
@@ -1939,7 +2077,11 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create
 		ExclusionJustification: input.ExclusionJustification,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot create control: %w", err)
+		var errAlreadyExists *coredata.ErrControlAlreadyExists
+		if errors.As(err, &errAlreadyExists) {
+			return nil, graphql.Conflict(errAlreadyExists)
+		}
+		panic(fmt.Errorf("cannot create control: %w", err))
 	}
 
 	return &types.CreateControlPayload{
@@ -1961,7 +2103,11 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update
 	})
 
 	if err != nil {
-		return nil, fmt.Errorf("cannot update control: %w", err)
+		var errAlreadyExists *coredata.ErrControlAlreadyExists
+		if errors.As(err, &errAlreadyExists) {
+			return nil, graphql.Conflict(errAlreadyExists)
+		}
+		panic(fmt.Errorf("cannot update control: %w", err))
 	}
 
 	return &types.UpdateControlPayload{
@@ -1975,7 +2121,7 @@ func (r *mutationResolver) DeleteControl(ctx context.Context, input types.Delete
 
 	err := prb.Controls.Delete(ctx, input.ControlID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete control: %w", err)
+		panic(fmt.Errorf("cannot delete control: %w", err))
 	}
 
 	return &types.DeleteControlPayload{
@@ -1994,6 +2140,10 @@ func (r *mutationResolver) CreateMeasure(ctx context.Context, input types.Create
 		Category:       input.Category,
 	})
 	if err != nil {
+		var errAlreadyExists *coredata.ErrMeasureAlreadyExists
+		if errors.As(err, &errAlreadyExists) {
+			return nil, graphql.Conflict(errAlreadyExists)
+		}
 		panic(fmt.Errorf("cannot create measure: %w", err))
 	}
 
@@ -2028,12 +2178,12 @@ func (r *mutationResolver) ImportMeasure(ctx context.Context, input types.Import
 
 	var req probo.ImportMeasureRequest
 	if err := json.NewDecoder(input.File.File).Decode(&req.Measures); err != nil {
-		return nil, fmt.Errorf("cannot unmarshal measure: %w", err)
+		panic(fmt.Errorf("cannot unmarshal measure: %w", err))
 	}
 
 	measures, err := prb.Measures.Import(ctx, input.OrganizationID, req)
 	if err != nil {
-		return nil, fmt.Errorf("cannot import measure: %w", err)
+		panic(fmt.Errorf("cannot import measure: %w", err))
 	}
 
 	measureEdges := make([]*types.MeasureEdge, len(measures.Data))
@@ -2083,7 +2233,7 @@ func (r *mutationResolver) CreateControlDocumentMapping(ctx context.Context, inp
 	if err != nil {
 		var errMappingExists *coredata.ErrControlDocumentMappingAlreadyExists
 		if errors.As(err, &errMappingExists) {
-			return nil, errors.New(errMappingExists.Error())
+			return nil, graphql.Conflict(errMappingExists)
 		}
 		panic(fmt.Errorf("cannot create control document mapping: %w", err))
 	}
@@ -2130,7 +2280,7 @@ func (r *mutationResolver) CreateControlAuditMapping(ctx context.Context, input
 
 	control, audit, err := prb.Controls.CreateAuditMapping(ctx, input.ControlID, input.AuditID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot create control audit mapping: %w", err)
+		panic(fmt.Errorf("cannot create control audit mapping: %w", err))
 	}
 
 	return &types.CreateControlAuditMappingPayload{
@@ -2145,7 +2295,7 @@ func (r *mutationResolver) DeleteControlAuditMapping(ctx context.Context, input
 
 	control, audit, err := prb.Controls.DeleteAuditMapping(ctx, input.ControlID, input.AuditID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete control audit mapping: %w", err)
+		panic(fmt.Errorf("cannot delete control audit mapping: %w", err))
 	}
 
 	return &types.DeleteControlAuditMappingPayload{
@@ -2197,6 +2347,10 @@ func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTas
 		Deadline:       input.Deadline,
 	})
 	if err != nil {
+		var errAlreadyExists *coredata.ErrTaskAlreadyExists
+		if errors.As(err, &errAlreadyExists) {
+			return nil, graphql.Conflict(errAlreadyExists)
+		}
 		panic(fmt.Errorf("cannot create task: %w", err))
 	}
 
@@ -2289,6 +2443,10 @@ func (r *mutationResolver) CreateRisk(ctx context.Context, input types.CreateRis
 		},
 	)
 	if err != nil {
+		var errAlreadyExists *coredata.ErrRiskAlreadyExists
+		if errors.As(err, &errAlreadyExists) {
+			return nil, graphql.Conflict(errAlreadyExists)
+		}
 		panic(fmt.Errorf("cannot create risk: %w", err))
 	}
 
@@ -2521,7 +2679,7 @@ func (r *mutationResolver) UploadVendorBusinessAssociateAgreement(ctx context.Co
 		},
 	)
 	if err != nil {
-		return nil, fmt.Errorf("cannot upload vendor business associate agreement: %w", err)
+		panic(fmt.Errorf("failed to upload vendor business associate agreement: %w", err))
 	}
 
 	return &types.UploadVendorBusinessAssociateAgreementPayload{
@@ -2542,7 +2700,7 @@ func (r *mutationResolver) UpdateVendorBusinessAssociateAgreement(ctx context.Co
 		},
 	)
 	if err != nil {
-		return nil, fmt.Errorf("cannot update vendor business associate agreement: %w", err)
+		panic(fmt.Errorf("failed to update vendor business associate agreement: %w", err))
 	}
 
 	return &types.UpdateVendorBusinessAssociateAgreementPayload{
@@ -2556,7 +2714,7 @@ func (r *mutationResolver) DeleteVendorBusinessAssociateAgreement(ctx context.Co
 
 	err := prb.VendorBusinessAssociateAgreements.DeleteByVendorID(ctx, input.VendorID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete vendor business associate agreement: %w", err)
+		panic(fmt.Errorf("failed to delete vendor business associate agreement: %w", err))
 	}
 
 	return &types.DeleteVendorBusinessAssociateAgreementPayload{
@@ -2579,7 +2737,7 @@ func (r *mutationResolver) UploadVendorDataPrivacyAgreement(ctx context.Context,
 		},
 	)
 	if err != nil {
-		return nil, fmt.Errorf("cannot upload vendor data privacy agreement: %w", err)
+		panic(fmt.Errorf("failed to upload vendor data privacy agreement: %w", err))
 	}
 
 	return &types.UploadVendorDataPrivacyAgreementPayload{
@@ -2600,7 +2758,7 @@ func (r *mutationResolver) UpdateVendorDataPrivacyAgreement(ctx context.Context,
 		},
 	)
 	if err != nil {
-		return nil, fmt.Errorf("cannot update vendor data privacy agreement: %w", err)
+		panic(fmt.Errorf("failed to update vendor data privacy agreement: %w", err))
 	}
 
 	return &types.UpdateVendorDataPrivacyAgreementPayload{
@@ -2614,7 +2772,7 @@ func (r *mutationResolver) DeleteVendorDataPrivacyAgreement(ctx context.Context,
 
 	err := prb.VendorDataPrivacyAgreements.DeleteByVendorID(ctx, input.VendorID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete vendor data privacy agreement: %w", err)
+		panic(fmt.Errorf("failed to delete vendor data privacy agreement: %w", err))
 	}
 
 	return &types.DeleteVendorDataPrivacyAgreementPayload{
@@ -2639,6 +2797,10 @@ func (r *mutationResolver) CreateDocument(ctx context.Context, input types.Creat
 		},
 	)
 	if err != nil {
+		var errAlreadyExists *coredata.ErrDocumentAlreadyExists
+		if errors.As(err, &errAlreadyExists) {
+			return nil, graphql.Conflict(errAlreadyExists)
+		}
 		panic(fmt.Errorf("cannot create document: %w", err))
 	}
 
@@ -2665,7 +2827,7 @@ func (r *mutationResolver) UpdateDocument(ctx context.Context, input types.Updat
 	)
 
 	if err != nil {
-		return nil, fmt.Errorf("cannot update document: %w", err)
+		panic(fmt.Errorf("cannot update document: %w", err))
 	}
 
 	return &types.UpdateDocumentPayload{
@@ -2694,6 +2856,10 @@ func (r *mutationResolver) PublishDocumentVersion(ctx context.Context, input typ
 
 	document, documentVersion, err := prb.Documents.PublishVersion(ctx, input.DocumentID, user.ID, input.Changelog)
 	if err != nil {
+		var errNoChanges *coredata.ErrDocumentVersionNoChanges
+		if errors.As(err, &errNoChanges) {
+			return nil, graphql.Invalid(errNoChanges)
+		}
 		panic(fmt.Errorf("cannot publish document version: %w", err))
 	}
 
@@ -2964,7 +3130,7 @@ func (r *mutationResolver) AssessVendor(ctx context.Context, input types.AssessV
 		WebsiteURL: input.WebsiteURL,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot assess vendor: %w", err)
+		panic(fmt.Errorf("cannot assess vendor: %w", err))
 	}
 
 	return &types.AssessVendorPayload{
@@ -2987,7 +3153,7 @@ func (r *mutationResolver) CreateAsset(ctx context.Context, input types.CreateAs
 	})
 
 	if err != nil {
-		return nil, fmt.Errorf("cannot create asset: %w", err)
+		panic(fmt.Errorf("cannot create asset: %w", err))
 	}
 
 	return &types.CreateAssetPayload{
@@ -3009,7 +3175,7 @@ func (r *mutationResolver) UpdateAsset(ctx context.Context, input types.UpdateAs
 		VendorIDs:       input.VendorIds,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot update asset: %w", err)
+		panic(fmt.Errorf("cannot update asset: %w", err))
 	}
 
 	return &types.UpdateAssetPayload{
@@ -3023,7 +3189,7 @@ func (r *mutationResolver) DeleteAsset(ctx context.Context, input types.DeleteAs
 
 	err := prb.Assets.Delete(ctx, input.AssetID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete asset: %w", err)
+		panic(fmt.Errorf("cannot delete asset: %w", err))
 	}
 
 	return &types.DeleteAssetPayload{
@@ -3044,7 +3210,7 @@ func (r *mutationResolver) CreateDatum(ctx context.Context, input types.CreateDa
 	})
 
 	if err != nil {
-		return nil, fmt.Errorf("cannot create datum: %w", err)
+		panic(fmt.Errorf("cannot create datum: %w", err))
 	}
 
 	return &types.CreateDatumPayload{
@@ -3065,7 +3231,7 @@ func (r *mutationResolver) UpdateDatum(ctx context.Context, input types.UpdateDa
 	})
 
 	if err != nil {
-		return nil, fmt.Errorf("cannot update datum: %w", err)
+		panic(fmt.Errorf("cannot update datum: %w", err))
 	}
 
 	return &types.UpdateDatumPayload{
@@ -3078,7 +3244,7 @@ func (r *mutationResolver) DeleteDatum(ctx context.Context, input types.DeleteDa
 	prb := r.ProboService(ctx, input.DatumID.TenantID())
 
 	if err := prb.Data.Delete(ctx, input.DatumID); err != nil {
-		return nil, fmt.Errorf("cannot delete datum: %w", err)
+		panic(fmt.Errorf("cannot delete datum: %w", err))
 	}
 
 	return &types.DeleteDatumPayload{
@@ -3177,7 +3343,7 @@ func (r *mutationResolver) DeleteAuditReport(ctx context.Context, input types.De
 
 	audit, err := prb.Audits.DeleteReport(ctx, input.AuditID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete audit report: %w", err)
+		panic(fmt.Errorf("cannot delete audit report: %w", err))
 	}
 
 	return &types.DeleteAuditReportPayload{
@@ -3247,7 +3413,7 @@ func (r *mutationResolver) DeleteNonconformity(ctx context.Context, input types.
 
 	err := prb.Nonconformities.Delete(ctx, input.NonconformityID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete nonconformity: %w", err)
+		panic(fmt.Errorf("cannot delete nonconformity: %w", err))
 	}
 
 	return &types.DeleteNonconformityPayload{
@@ -3508,7 +3674,7 @@ func (r *mutationResolver) CreateCustomDomain(ctx context.Context, input types.C
 		Domain:         input.Domain,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot create custom domain: %w", err)
+		panic(fmt.Errorf("failed to create custom domain: %w", err))
 	}
 
 	return &types.CreateCustomDomainPayload{
@@ -3523,7 +3689,7 @@ func (r *mutationResolver) DeleteCustomDomain(ctx context.Context, input types.D
 	// Get the current custom domain ID before deleting
 	domain, err := prb.CustomDomains.GetOrganizationCustomDomain(ctx, input.OrganizationID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get custom domain: %w", err)
+		panic(fmt.Errorf("failed to get custom domain: %w", err))
 	}
 
 	if domain == nil {
@@ -3533,7 +3699,7 @@ func (r *mutationResolver) DeleteCustomDomain(ctx context.Context, input types.D
 	deletedDomainID := domain.ID
 
 	if err := prb.CustomDomains.DeleteCustomDomain(ctx, input.OrganizationID); err != nil {
-		return nil, fmt.Errorf("cannot delete custom domain: %w", err)
+		panic(fmt.Errorf("failed to delete custom domain: %w", err))
 	}
 
 	return &types.DeleteCustomDomainPayload{
@@ -3766,12 +3932,16 @@ func (r *nonconformityResolver) Organization(ctx context.Context, obj *types.Non
 
 	nonconformity, err := prb.Nonconformities.Get(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get nonconformity: %w", err)
+		panic(fmt.Errorf("cannot get nonconformity: %w", err))
 	}
 
 	organization, err := prb.Organizations.Get(ctx, nonconformity.OrganizationID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get nonconformity organization: %w", err)
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot get nonconformity organization: %w", err))
 	}
 
 	return types.NewOrganization(organization), nil
@@ -3783,12 +3953,16 @@ func (r *nonconformityResolver) Audit(ctx context.Context, obj *types.Nonconform
 
 	nonconformity, err := prb.Nonconformities.Get(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get nonconformity: %w", err)
+		panic(fmt.Errorf("cannot get nonconformity: %w", err))
 	}
 
 	audit, err := prb.Audits.Get(ctx, nonconformity.AuditID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get nonconformity audit: %w", err)
+		var errNotFound *coredata.ErrAuditNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot get nonconformity audit: %w", err))
 	}
 
 	return types.NewAudit(audit), nil
@@ -3800,12 +3974,16 @@ func (r *nonconformityResolver) Owner(ctx context.Context, obj *types.Nonconform
 
 	nonconformity, err := prb.Nonconformities.Get(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get nonconformity: %w", err)
+		panic(fmt.Errorf("cannot get nonconformity: %w", err))
 	}
 
 	people, err := prb.Peoples.Get(ctx, nonconformity.OwnerID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get nonconformity owner: %w", err)
+		var errNotFound *coredata.ErrPeopleNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot get nonconformity owner: %w", err))
 	}
 
 	return types.NewPeople(people), nil
@@ -3824,12 +4002,12 @@ func (r *nonconformityConnectionResolver) TotalCount(ctx context.Context, obj *t
 
 		count, err := prb.Nonconformities.CountForOrganizationID(ctx, obj.ParentID, nonconformityFilter)
 		if err != nil {
-			return 0, fmt.Errorf("cannot count nonconformities: %w", err)
+			panic(fmt.Errorf("cannot count nonconformities: %w", err))
 		}
 		return count, nil
 	}
 
-	return 0, fmt.Errorf("unsupported resolver: %T", obj.Resolver)
+	panic(fmt.Errorf("unsupported resolver: %T", obj.Resolver))
 }
 
 // Organization is the resolver for the organization field.
@@ -3838,12 +4016,16 @@ func (r *obligationResolver) Organization(ctx context.Context, obj *types.Obliga
 
 	obligation, err := prb.Obligations.Get(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get obligation: %w", err)
+		panic(fmt.Errorf("cannot get obligation: %w", err))
 	}
 
 	organization, err := prb.Organizations.Get(ctx, obligation.OrganizationID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get obligation organization: %w", err)
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot get obligation organization: %w", err))
 	}
 
 	return types.NewOrganization(organization), nil
@@ -3855,12 +4037,16 @@ func (r *obligationResolver) Owner(ctx context.Context, obj *types.Obligation) (
 
 	obligation, err := prb.Obligations.Get(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get obligation: %w", err)
+		panic(fmt.Errorf("cannot get obligation: %w", err))
 	}
 
 	people, err := prb.Peoples.Get(ctx, obligation.OwnerID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get obligation owner: %w", err)
+		var errNotFound *coredata.ErrPeopleNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot get obligation owner: %w", err))
 	}
 
 	return types.NewPeople(people), nil
@@ -3895,7 +4081,7 @@ func (r *obligationConnectionResolver) TotalCount(ctx context.Context, obj *type
 		return count, nil
 	}
 
-	return 0, fmt.Errorf("unsupported resolver: %T", obj.Resolver)
+	panic(fmt.Errorf("unsupported resolver: %T", obj.Resolver))
 }
 
 // LogoURL is the resolver for the logoUrl field.
@@ -4037,7 +4223,7 @@ func (r *organizationResolver) Controls(ctx context.Context, obj *types.Organiza
 
 	page, err := prb.Controls.ListForOrganizationID(ctx, obj.ID, cursor, controlFilter)
 	if err != nil {
-		return nil, fmt.Errorf("cannot list controls: %w", err)
+		panic(fmt.Errorf("cannot list controls: %w", err))
 	}
 
 	return types.NewControlConnection(page, r, obj.ID, controlFilter), nil
@@ -4495,7 +4681,7 @@ func (r *organizationResolver) CustomDomain(ctx context.Context, obj *types.Orga
 
 	domain, err := prb.CustomDomains.GetOrganizationCustomDomain(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get custom domain: %w", err)
+		panic(fmt.Errorf("failed to get custom domain: %w", err))
 	}
 
 	if domain == nil {
@@ -4554,6 +4740,10 @@ func (r *processingActivityResolver) Organization(ctx context.Context, obj *type
 
 	organization, err := prb.Organizations.Get(ctx, processingActivity.OrganizationID)
 	if err != nil {
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get organization: %w", err))
 	}
 
@@ -4614,6 +4804,10 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 	case coredata.OrganizationEntityType:
 		organization, err := prb.Organizations.Get(ctx, id)
 		if err != nil {
+			var errNotFound *coredata.ErrOrganizationNotFound
+			if errors.As(err, &errNotFound) {
+				return nil, graphql.NotFound(errNotFound)
+			}
 			panic(fmt.Errorf("cannot get organization: %w", err))
 		}
 
@@ -4621,6 +4815,10 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 	case coredata.PeopleEntityType:
 		people, err := prb.Peoples.Get(ctx, id)
 		if err != nil {
+			var errNotFound *coredata.ErrPeopleNotFound
+			if errors.As(err, &errNotFound) {
+				return nil, graphql.NotFound(errNotFound)
+			}
 			panic(fmt.Errorf("cannot get people: %w", err))
 		}
 
@@ -4628,6 +4826,10 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 	case coredata.VendorEntityType:
 		vendor, err := prb.Vendors.Get(ctx, id)
 		if err != nil {
+			var errNotFound *coredata.ErrVendorNotFound
+			if errors.As(err, &errNotFound) {
+				return nil, graphql.NotFound(errNotFound)
+			}
 			panic(fmt.Errorf("cannot get vendor: %w", err))
 		}
 
@@ -4635,6 +4837,10 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 	case coredata.FrameworkEntityType:
 		framework, err := prb.Frameworks.Get(ctx, id)
 		if err != nil {
+			var errNotFound *coredata.ErrFrameworkNotFound
+			if errors.As(err, &errNotFound) {
+				return nil, graphql.NotFound(errNotFound)
+			}
 			panic(fmt.Errorf("cannot get framework: %w", err))
 		}
 
@@ -4642,6 +4848,10 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 	case coredata.MeasureEntityType:
 		measure, err := prb.Measures.Get(ctx, id)
 		if err != nil {
+			var errNotFound *coredata.ErrMeasureNotFound
+			if errors.As(err, &errNotFound) {
+				return nil, graphql.NotFound(errNotFound)
+			}
 			panic(fmt.Errorf("cannot get measure: %w", err))
 		}
 
@@ -4649,6 +4859,10 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 	case coredata.TaskEntityType:
 		task, err := prb.Tasks.Get(ctx, id)
 		if err != nil {
+			var errNotFound *coredata.ErrTaskNotFound
+			if errors.As(err, &errNotFound) {
+				return nil, graphql.NotFound(errNotFound)
+			}
 			panic(fmt.Errorf("cannot get task: %w", err))
 		}
 
@@ -4663,12 +4877,20 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 	case coredata.DocumentEntityType:
 		document, err := prb.Documents.Get(ctx, id)
 		if err != nil {
+			var errNotFound *coredata.ErrDocumentNotFound
+			if errors.As(err, &errNotFound) {
+				return nil, graphql.NotFound(errNotFound)
+			}
 			panic(fmt.Errorf("cannot get document: %w", err))
 		}
 		return types.NewDocument(document), nil
 	case coredata.ControlEntityType:
 		control, err := prb.Controls.Get(ctx, id)
 		if err != nil {
+			var errNotFound *coredata.ErrControlNotFound
+			if errors.As(err, &errNotFound) {
+				return nil, graphql.NotFound(errNotFound)
+			}
 			panic(fmt.Errorf("cannot get control: %w", err))
 		}
 
@@ -4676,6 +4898,10 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 	case coredata.RiskEntityType:
 		risk, err := prb.Risks.Get(ctx, id)
 		if err != nil {
+			var errNotFound *coredata.ErrRiskNotFound
+			if errors.As(err, &errNotFound) {
+				return nil, graphql.NotFound(errNotFound)
+			}
 			panic(fmt.Errorf("cannot get risk: %w", err))
 		}
 		return types.NewRisk(risk), nil
@@ -4712,6 +4938,10 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 	case coredata.AssetEntityType:
 		asset, err := prb.Assets.Get(ctx, id)
 		if err != nil {
+			var errNotFound *coredata.ErrAssetNotFound
+			if errors.As(err, &errNotFound) {
+				return nil, graphql.NotFound(errNotFound)
+			}
 			panic(fmt.Errorf("cannot get asset: %w", err))
 		}
 		return types.NewAsset(asset), nil
@@ -4724,6 +4954,10 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 	case coredata.AuditEntityType:
 		audit, err := prb.Audits.Get(ctx, id)
 		if err != nil {
+			var errNotFound *coredata.ErrAuditNotFound
+			if errors.As(err, &errNotFound) {
+				return nil, graphql.NotFound(errNotFound)
+			}
 			panic(fmt.Errorf("cannot get audit: %w", err))
 		}
 		return types.NewAudit(audit), nil
@@ -4780,7 +5014,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 	default:
 	}
 
-	return nil, gqlerror.Errorf("node %q not found", id)
+	panic(fmt.Errorf("unknown entity type: %d", id.EntityType()))
 }
 
 // Viewer is the resolver for the viewer field.
@@ -4812,7 +5046,7 @@ func (r *reportResolver) Audit(ctx context.Context, obj *types.Report) (*types.A
 
 	audit, err := prb.Audits.GetByReportID(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot load audit for report: %w", err)
+		panic(fmt.Errorf("cannot load audit for report: %w", err))
 	}
 
 	return types.NewAudit(audit), nil
@@ -4824,6 +5058,10 @@ func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.Peopl
 
 	risk, err := prb.Risks.Get(ctx, obj.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrRiskNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get risk: %w", err))
 	}
 
@@ -4833,6 +5071,10 @@ func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.Peopl
 
 	owner, err := prb.Peoples.Get(ctx, *risk.OwnerID)
 	if err != nil {
+		var errNotFound *coredata.ErrPeopleNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get owner: %w", err))
 	}
 
@@ -4845,11 +5087,19 @@ func (r *riskResolver) Organization(ctx context.Context, obj *types.Risk) (*type
 
 	risk, err := prb.Risks.Get(ctx, obj.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrRiskNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get risk: %w", err))
 	}
 
 	organization, err := prb.Organizations.Get(ctx, risk.OrganizationID)
 	if err != nil {
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get organization: %w", err))
 	}
 
@@ -5044,6 +5294,10 @@ func (r *snapshotResolver) Organization(ctx context.Context, obj *types.Snapshot
 
 	organization, err := prb.Organizations.Get(ctx, snapshot.OrganizationID)
 	if err != nil {
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get organization: %w", err))
 	}
 
@@ -5102,6 +5356,10 @@ func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types.
 
 	task, err := prb.Tasks.Get(ctx, obj.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrTaskNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get task: %w", err))
 	}
 
@@ -5111,6 +5369,10 @@ func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types.
 
 	people, err := prb.Peoples.Get(ctx, *task.AssignedToID)
 	if err != nil {
+		var errNotFound *coredata.ErrPeopleNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get assigned to: %w", err))
 	}
 
@@ -5123,11 +5385,19 @@ func (r *taskResolver) Organization(ctx context.Context, obj *types.Task) (*type
 
 	task, err := prb.Tasks.Get(ctx, obj.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrTaskNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get task: %w", err))
 	}
 
 	organization, err := prb.Organizations.Get(ctx, task.OrganizationID)
 	if err != nil {
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get organization: %w", err))
 	}
 
@@ -5140,11 +5410,19 @@ func (r *taskResolver) Measure(ctx context.Context, obj *types.Task) (*types.Mea
 
 	task, err := prb.Tasks.Get(ctx, obj.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrTaskNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get task: %w", err))
 	}
 
 	measure, err := prb.Measures.Get(ctx, *task.MeasureID)
 	if err != nil {
+		var errNotFound *coredata.ErrMeasureNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get measure: %w", err))
 	}
 
@@ -5215,6 +5493,10 @@ func (r *trustCenterResolver) Organization(ctx context.Context, obj *types.Trust
 
 	organization, err := prb.Organizations.Get(ctx, obj.Organization.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get organization: %w", err))
 	}
 
@@ -5330,6 +5612,10 @@ func (r *trustCenterDocumentAccessResolver) Document(ctx context.Context, obj *t
 
 	document, err := prb.Documents.Get(ctx, *obj.DocumentID)
 	if err != nil {
+		var errNotFound *coredata.ErrDocumentNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		return nil, fmt.Errorf("cannot load document: %w", err)
 	}
 
@@ -5346,7 +5632,7 @@ func (r *trustCenterDocumentAccessResolver) Report(ctx context.Context, obj *typ
 
 	report, err := prb.Reports.Get(ctx, *obj.ReportID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot load report: %w", err)
+		panic(fmt.Errorf("cannot load report: %w", err))
 	}
 
 	return types.NewReport(report), nil
@@ -5362,7 +5648,7 @@ func (r *trustCenterDocumentAccessResolver) TrustCenterFile(ctx context.Context,
 
 	trustCenterFile, err := prb.TrustCenterFiles.Get(ctx, *obj.TrustCenterFileID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot load trust center file: %w", err)
+		panic(fmt.Errorf("cannot load trust center file: %w", err))
 	}
 
 	return types.NewTrustCenterFile(trustCenterFile), nil
@@ -5374,7 +5660,7 @@ func (r *trustCenterDocumentAccessConnectionResolver) TotalCount(ctx context.Con
 
 	count, err := prb.TrustCenterAccesses.CountDocumentAccesses(ctx, obj.ParentID)
 	if err != nil {
-		return 0, fmt.Errorf("cannot count trust center document accesses: %w", err)
+		panic(fmt.Errorf("cannot count trust center document accesses: %w", err))
 	}
 
 	return count, nil
@@ -5403,6 +5689,10 @@ func (r *trustCenterFileResolver) Organization(ctx context.Context, obj *types.T
 
 	organization, err := prb.Organizations.Get(ctx, file.OrganizationID)
 	if err != nil {
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get organization: %w", err))
 	}
 
@@ -5464,11 +5754,19 @@ func (r *vendorResolver) Organization(ctx context.Context, obj *types.Vendor) (*
 
 	vendor, err := prb.Vendors.Get(ctx, obj.ID)
 	if err != nil {
+		var errNotFound *coredata.ErrVendorNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get vendor: %w", err))
 	}
 
 	organization, err := prb.Organizations.Get(ctx, vendor.OrganizationID)
 	if err != nil {
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
 		panic(fmt.Errorf("cannot get organization: %w", err))
 	}
 
@@ -5613,7 +5911,11 @@ func (r *vendorResolver) BusinessOwner(ctx context.Context, obj *types.Vendor) (
 
 	vendor, err := prb.Vendors.Get(ctx, obj.ID)
 	if err != nil {
-		panic(fmt.Errorf("cannot get vendor: %w", err))
+		var errNotFound *coredata.ErrVendorNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("failed to get vendor: %w", err))
 	}
 
 	if vendor.BusinessOwnerID == nil {
@@ -5622,7 +5924,11 @@ func (r *vendorResolver) BusinessOwner(ctx context.Context, obj *types.Vendor) (
 
 	people, err := prb.Peoples.Get(ctx, *vendor.BusinessOwnerID)
 	if err != nil {
-		panic(fmt.Errorf("cannot get business owner: %w", err))
+		var errNotFound *coredata.ErrPeopleNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("failed to get business owner: %w", err))
 	}
 
 	return types.NewPeople(people), nil
@@ -5633,7 +5939,11 @@ func (r *vendorResolver) SecurityOwner(ctx context.Context, obj *types.Vendor) (
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 	vendor, err := prb.Vendors.Get(ctx, obj.ID)
 	if err != nil {
-		panic(fmt.Errorf("cannot get vendor: %w", err))
+		var errNotFound *coredata.ErrVendorNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("failed to get vendor: %w", err))
 	}
 
 	if vendor.SecurityOwnerID == nil {
@@ -5642,7 +5952,11 @@ func (r *vendorResolver) SecurityOwner(ctx context.Context, obj *types.Vendor) (
 
 	people, err := prb.Peoples.Get(ctx, *vendor.SecurityOwnerID)
 	if err != nil {
-		panic(fmt.Errorf("cannot get security owner: %w", err))
+		var errNotFound *coredata.ErrPeopleNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("failed to get security owner: %w", err))
 	}
 
 	return types.NewPeople(people), nil
@@ -5654,7 +5968,11 @@ func (r *vendorBusinessAssociateAgreementResolver) Vendor(ctx context.Context, o
 
 	vendor, err := prb.Vendors.Get(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get vendor: %w", err)
+		var errNotFound *coredata.ErrVendorNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		return nil, fmt.Errorf("failed to get vendor: %w", err)
 	}
 
 	return types.NewVendor(vendor), nil
@@ -5666,7 +5984,7 @@ func (r *vendorBusinessAssociateAgreementResolver) FileURL(ctx context.Context,
 
 	fileURL, err := prb.VendorBusinessAssociateAgreements.GenerateFileURL(ctx, obj.ID, 1*time.Hour)
 	if err != nil {
-		return "", fmt.Errorf("cannot generate file URL: %w", err)
+		panic(fmt.Errorf("failed to generate file URL: %w", err))
 	}
 
 	return fileURL, nil
@@ -5678,7 +5996,11 @@ func (r *vendorComplianceReportResolver) Vendor(ctx context.Context, obj *types.
 
 	vendor, err := prb.Vendors.Get(ctx, obj.ID)
 	if err != nil {
-		panic(fmt.Errorf("cannot get vendor: %w", err))
+		var errNotFound *coredata.ErrVendorNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("failed to get vendor: %w", err))
 	}
 
 	return types.NewVendor(vendor), nil
@@ -5690,7 +6012,7 @@ func (r *vendorComplianceReportResolver) File(ctx context.Context, obj *types.Ve
 
 	evidence, err := prb.VendorComplianceReports.Get(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot load evidence: %w", err)
+		panic(fmt.Errorf("cannot load evidence: %w", err))
 	}
 
 	if evidence.ReportFileId == nil {
@@ -5699,7 +6021,11 @@ func (r *vendorComplianceReportResolver) File(ctx context.Context, obj *types.Ve
 
 	file, err := prb.Files.Get(ctx, *evidence.ReportFileId)
 	if err != nil {
-		return nil, fmt.Errorf("cannot load evidence file: %w", err)
+		var errNotFound *coredata.ErrFileNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot load evidence file: %w", err))
 	}
 
 	return types.NewFile(file), nil
@@ -5745,7 +6071,11 @@ func (r *vendorContactResolver) Vendor(ctx context.Context, obj *types.VendorCon
 
 	vendor, err := prb.Vendors.Get(ctx, vendorContact.VendorID)
 	if err != nil {
-		panic(fmt.Errorf("cannot get vendor: %w", err))
+		var errNotFound *coredata.ErrVendorNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("failed to get vendor: %w", err))
 	}
 
 	return types.NewVendor(vendor), nil
@@ -5757,7 +6087,11 @@ func (r *vendorDataPrivacyAgreementResolver) Vendor(ctx context.Context, obj *ty
 
 	vendor, err := prb.Vendors.Get(ctx, obj.ID)
 	if err != nil {
-		panic(fmt.Errorf("cannot get vendor: %w", err))
+		var errNotFound *coredata.ErrVendorNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("failed to get vendor: %w", err))
 	}
 
 	return types.NewVendor(vendor), nil
@@ -5781,7 +6115,11 @@ func (r *vendorRiskAssessmentResolver) Vendor(ctx context.Context, obj *types.Ve
 
 	vendor, err := prb.Vendors.Get(ctx, obj.ID)
 	if err != nil {
-		panic(fmt.Errorf("cannot get vendor: %w", err))
+		var errNotFound *coredata.ErrVendorNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("failed to get vendor: %w", err))
 	}
 
 	return types.NewVendor(vendor), nil
@@ -5799,7 +6137,11 @@ func (r *vendorServiceResolver) Vendor(ctx context.Context, obj *types.VendorSer
 
 	vendor, err := prb.Vendors.Get(ctx, vendorService.VendorID)
 	if err != nil {
-		panic(fmt.Errorf("cannot get vendor: %w", err))
+		var errNotFound *coredata.ErrVendorNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, graphql.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("failed to get vendor: %w", err))
 	}
 
 	return types.NewVendor(vendor), nil
diff --git a/pkg/server/graphql/errors.go b/pkg/server/graphql/errors.go
new file mode 100644
index 000000000..daa1761e1
--- /dev/null
+++ b/pkg/server/graphql/errors.go
@@ -0,0 +1,69 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package graphql
+
+import (
+	"maps"
+
+	"github.com/vektah/gqlparser/v2/gqlerror"
+)
+
+func Unauthorized() *gqlerror.Error {
+	return &gqlerror.Error{
+		Message: "not authorized",
+		Extensions: map[string]any{
+			"code": "UNAUTHORIZED",
+		},
+	}
+}
+
+func AuthenticationRequired(details map[string]any) *gqlerror.Error {
+	extensions := map[string]any{
+		"code": "AUTHENTICATION_REQUIRED",
+	}
+	maps.Copy(extensions, details)
+
+	return &gqlerror.Error{
+		Message:    "Additional authentication required to access this organization",
+		Extensions: extensions,
+	}
+}
+
+func NotFound(err error) *gqlerror.Error {
+	return &gqlerror.Error{
+		Message: err.Error(),
+		Extensions: map[string]any{
+			"code": "NOT_FOUND",
+		},
+	}
+}
+
+func Conflict(err error) *gqlerror.Error {
+	return &gqlerror.Error{
+		Message: err.Error(),
+		Extensions: map[string]any{
+			"code": "CONFLICT",
+		},
+	}
+}
+
+func Invalid(err error) *gqlerror.Error {
+	return &gqlerror.Error{
+		Message: err.Error(),
+		Extensions: map[string]any{
+			"code": "INVALID",
+		},
+	}
+}
diff --git a/pkg/server/graphql/recovery.go b/pkg/server/graphql/recovery.go
index fc38729f8..e88bf6ad3 100644
--- a/pkg/server/graphql/recovery.go
+++ b/pkg/server/graphql/recovery.go
@@ -20,6 +20,7 @@ import (
 	"runtime/debug"
 
 	"github.com/getprobo/probo/pkg/auth"
+	"github.com/getprobo/probo/pkg/authz"
 	"github.com/vektah/gqlparser/v2/gqlerror"
 	"go.gearno.de/kit/httpserver"
 	"go.gearno.de/kit/log"
@@ -32,29 +33,26 @@ func RecoverFunc(ctx context.Context, err any) error {
 
 	var errSAMLRequired auth.ErrSAMLAuthRequired
 	if errors.As(asError(err), &errSAMLRequired) {
-		return &gqlerror.Error{
-			Message: "Additional authentication required to access this organization",
-			Extensions: map[string]any{
-				"code":           "AUTHENTICATION_REQUIRED",
-				"requiresSaml":   true,
-				"redirectUrl":    errSAMLRequired.RedirectURL,
-				"samlConfigId":   errSAMLRequired.ConfigID.String(),
-				"organizationId": errSAMLRequired.OrganizationID.String(),
-			},
-		}
+		return AuthenticationRequired(map[string]any{
+			"requiresSaml":   true,
+			"redirectUrl":    errSAMLRequired.RedirectURL,
+			"samlConfigId":   errSAMLRequired.ConfigID.String(),
+			"organizationId": errSAMLRequired.OrganizationID.String(),
+		})
 	}
 
 	var errPasswordRequired auth.ErrPasswordAuthRequired
 	if errors.As(asError(err), &errPasswordRequired) {
-		return &gqlerror.Error{
-			Message: "Additional authentication required to access this organization",
-			Extensions: map[string]any{
-				"code":           "AUTHENTICATION_REQUIRED",
-				"requiresSaml":   false,
-				"redirectUrl":    errPasswordRequired.RedirectURL,
-				"organizationId": errPasswordRequired.OrganizationID.String(),
-			},
-		}
+		return AuthenticationRequired(map[string]any{
+			"requiresSaml":   false,
+			"redirectUrl":    errPasswordRequired.RedirectURL,
+			"organizationId": errPasswordRequired.OrganizationID.String(),
+		})
+	}
+
+	var tenantAccessErr *authz.TenantAccessError
+	if errTyped, ok := err.(error); ok && errors.As(errTyped, &tenantAccessErr) {
+		return Unauthorized()
 	}
 
 	logger := httpserver.LoggerFromContext(ctx)