Common, I didn't want to downplay security checks, but understand which kind of error handling you mean. A check whether the user has the right to this Post-request makes sense for me. I will add that.

But I do not understand why to check for user not found, or role_level not found. As you said it will raise an exception. I mean the data is send by the frontend, but there is no user input but just defined values (user_id = hidden field, and role_level is a defined set of data). If the user changes these values by hand, it is from my point of view right that a exception is raised and the user get's an exception page. 

To redirect him in this case complicates the code more than the change would be useful up to me.