diff --git a/crates/manager-core/src/docs_service.rs b/crates/manager-core/src/docs_service.rs
index 1a31eed..0e86829 100644
--- a/crates/manager-core/src/docs_service.rs
+++ b/crates/manager-core/src/docs_service.rs
@@ -56,18 +56,24 @@ impl DocsServiceImpl {
 
     async fn check_read(&self, cx: &SdkCallCx) -> Result<(), DocsError> {
         if let Some(ref principal) = cx.principal {
-            authz::require(&*self.authz, principal, Capability::AppDocsRead(cx.app_id))
-                .await
-                .map_err(|_| DocsError::Forbidden)?;
+            match authz::require(&*self.authz, principal, Capability::AppDocsRead(cx.app_id)).await
+            {
+                Ok(()) => {}
+                Err(authz::AuthzDenied::Denied) => return Err(DocsError::Forbidden),
+                Err(authz::AuthzDenied::Repo(e)) => return Err(DocsError::Backend(e.to_string())),
+            }
         }
         Ok(())
     }
 
     async fn check_write(&self, cx: &SdkCallCx) -> Result<(), DocsError> {
         if let Some(ref principal) = cx.principal {
-            authz::require(&*self.authz, principal, Capability::AppDocsWrite(cx.app_id))
-                .await
-                .map_err(|_| DocsError::Forbidden)?;
+            match authz::require(&*self.authz, principal, Capability::AppDocsWrite(cx.app_id)).await
+            {
+                Ok(()) => {}
+                Err(authz::AuthzDenied::Denied) => return Err(DocsError::Forbidden),
+                Err(authz::AuthzDenied::Repo(e)) => return Err(DocsError::Backend(e.to_string())),
+            }
         }
         Ok(())
     }
diff --git a/crates/manager-core/src/files_service.rs b/crates/manager-core/src/files_service.rs
index 443f0bd..78de53d 100644
--- a/crates/manager-core/src/files_service.rs
+++ b/crates/manager-core/src/files_service.rs
@@ -50,22 +50,30 @@ impl FilesServiceImpl {
 
     async fn check_read(&self, cx: &SdkCallCx) -> Result<(), FilesError> {
         if let Some(ref principal) = cx.principal {
-            authz::require(&*self.authz, principal, Capability::AppFilesRead(cx.app_id))
+            match authz::require(&*self.authz, principal, Capability::AppFilesRead(cx.app_id))
                 .await
-                .map_err(|_| FilesError::Forbidden)?;
+            {
+                Ok(()) => {}
+                Err(authz::AuthzDenied::Denied) => return Err(FilesError::Forbidden),
+                Err(authz::AuthzDenied::Repo(e)) => return Err(FilesError::Backend(e.to_string())),
+            }
         }
         Ok(())
     }
 
     async fn check_write(&self, cx: &SdkCallCx) -> Result<(), FilesError> {
         if let Some(ref principal) = cx.principal {
-            authz::require(
+            match authz::require(
                 &*self.authz,
                 principal,
                 Capability::AppFilesWrite(cx.app_id),
             )
             .await
-            .map_err(|_| FilesError::Forbidden)?;
+            {
+                Ok(()) => {}
+                Err(authz::AuthzDenied::Denied) => return Err(FilesError::Forbidden),
+                Err(authz::AuthzDenied::Repo(e)) => return Err(FilesError::Backend(e.to_string())),
+            }
         }
         Ok(())
     }
diff --git a/crates/manager-core/src/kv_service.rs b/crates/manager-core/src/kv_service.rs
index d38dc67..7a5bc4a 100644
--- a/crates/manager-core/src/kv_service.rs
+++ b/crates/manager-core/src/kv_service.rs
@@ -47,18 +47,22 @@ impl KvServiceImpl {
 
     async fn check_read(&self, cx: &SdkCallCx) -> Result<(), KvError> {
         if let Some(ref principal) = cx.principal {
-            authz::require(&*self.authz, principal, Capability::AppKvRead(cx.app_id))
-                .await
-                .map_err(|_| KvError::Forbidden)?;
+            match authz::require(&*self.authz, principal, Capability::AppKvRead(cx.app_id)).await {
+                Ok(()) => {}
+                Err(authz::AuthzDenied::Denied) => return Err(KvError::Forbidden),
+                Err(authz::AuthzDenied::Repo(e)) => return Err(KvError::Backend(e.to_string())),
+            }
         }
         Ok(())
     }
 
     async fn check_write(&self, cx: &SdkCallCx) -> Result<(), KvError> {
         if let Some(ref principal) = cx.principal {
-            authz::require(&*self.authz, principal, Capability::AppKvWrite(cx.app_id))
-                .await
-                .map_err(|_| KvError::Forbidden)?;
+            match authz::require(&*self.authz, principal, Capability::AppKvWrite(cx.app_id)).await {
+                Ok(()) => {}
+                Err(authz::AuthzDenied::Denied) => return Err(KvError::Forbidden),
+                Err(authz::AuthzDenied::Repo(e)) => return Err(KvError::Backend(e.to_string())),
+            }
         }
         Ok(())
     }
diff --git a/crates/manager-core/src/pubsub_service.rs b/crates/manager-core/src/pubsub_service.rs
index 13c6451..5f84fac 100644
--- a/crates/manager-core/src/pubsub_service.rs
+++ b/crates/manager-core/src/pubsub_service.rs
@@ -115,13 +115,17 @@ impl PubsubServiceImpl {
 
     async fn check_publish(&self, cx: &SdkCallCx) -> Result<(), PubsubError> {
         if let Some(ref principal) = cx.principal {
-            authz::require(
+            match authz::require(
                 &*self.authz,
                 principal,
                 Capability::AppPubsubPublish(cx.app_id),
             )
             .await
-            .map_err(|_| PubsubError::Forbidden)?;
+            {
+                Ok(()) => {}
+                Err(authz::AuthzDenied::Denied) => return Err(PubsubError::Forbidden),
+                Err(authz::AuthzDenied::Repo(e)) => return Err(PubsubError::Backend(e.to_string())),
+            }
         }
         Ok(())
     }
@@ -217,13 +221,17 @@ impl PubsubService for PubsubServiceImpl {
         };
         // Minting reuses the existing pub/sub publish capability (no new
         // scope — the seven-scope commitment holds).
-        authz::require(
+        match authz::require(
             &*self.authz,
             principal,
             Capability::AppPubsubPublish(cx.app_id),
         )
         .await
-        .map_err(|_| PubsubError::Forbidden)?;
+        {
+            Ok(()) => {}
+            Err(authz::AuthzDenied::Denied) => return Err(PubsubError::Forbidden),
+            Err(authz::AuthzDenied::Repo(e)) => return Err(PubsubError::Backend(e.to_string())),
+        }
 
         let (Some(topic_repo), Some(secrets)) = (self.topics.as_ref(), self.secrets.as_ref())
         else {
diff --git a/crates/manager-core/src/queue_service.rs b/crates/manager-core/src/queue_service.rs
index 5558dec..0c0dde2 100644
--- a/crates/manager-core/src/queue_service.rs
+++ b/crates/manager-core/src/queue_service.rs
@@ -59,13 +59,17 @@ impl QueueService for QueueServiceImpl {
         // check (cx.principal is None); authenticated callers must hold
         // AppQueueEnqueue.
         if let Some(principal) = cx.principal.as_ref() {
-            authz::require(
+            match authz::require(
                 &*self.authz,
                 principal,
                 Capability::AppQueueEnqueue(cx.app_id),
             )
             .await
-            .map_err(|_| QueueError::Forbidden)?;
+            {
+                Ok(()) => {}
+                Err(authz::AuthzDenied::Denied) => return Err(QueueError::Forbidden),
+                Err(authz::AuthzDenied::Repo(e)) => return Err(QueueError::Backend(e.to_string())),
+            }
         }
 
         let deliver_after = opts