Preserve authorization denial reasons through to user-facing errors
When several access gates share one denial dialog, its wording cannot identify the failing gate. Preserve distinct internal reason codes for membership, team scope, and hidden-record visibility; show guidance that matches the authorized reason without exposing inaccessible data. …