- When a list 403s, treat it as if it were empty - When a single resource 403s, redirect to an application error page that has a backdoor link to the tokens page