Thinking about this more; is there any case in normal operation that the authorization won't be found? Do authorizations go away? If not, then I think it's OK for a 404 to just bubble up as an exception always - basically means you passed in a totally bogus reference and should just stop that.