Update notes for submitted changes

* Return 403 instead of 404 on attr policy failures