The server stopped one action for a kind of record, but the page still showed its buttons and the handler checked a credential first. Users kept clicking a dead button and were told to renew a key that could never help.
Remove a rule's buttons when you add the rule. A refusal the page still offers is a dead end.
Answer the real refusal before any other check. An earlier check hides why it failed.
Answer the real refusal before any other check. An earlier check hides why it failed.