backend: add error variant for access denied, handle when diffing

backend: add error variant for access denied, handle when diffing #2021