If you do an operation like AddOrder but don't have permission, then the client code just returns a "Request didn't return a HTTP Status 200" message, which is not very informative. The server does actually return a diagnostic message with a code such as INSUFFICIENT_RIGHTS, but this message is currently discarded.