I'm torn, part of me would like to see this be a single if NOT canAccess and throw the exception from there and leave the getEntitlements as the main body.

```
if (!principal.canAccess(o, Access.READ_POOLS)) {
    throw new ForbiddenException(i18n.tr("User {0} cannot access owner {1}",
        principal.getPrincipalName(), o.getKey()));
}

List<Entitlement> entitlements = new ArrayList<Entitlement>();
entitlements.addAll(pool.getEntitlements());
return entitlements;
```