add not_found on access denied