Honestly, we could be 'more confident' and just let it blow up if a resource is 'protected!' but credentials weren't passed (or a blanket rescue with a halt)...