it's a leaky abstraction to not have the models swallow underlying exceptions, but probably not worth it