if principal can't even see other principal return an authz error instead of a permissions error.