our code may only throw user errors