namespace CalledIt.Domain.Exceptions;

// Thrown when an authenticated caller lacks permission for the operation
// (e.g. not a group member, not the group owner). Maps to HTTP 403.
// Distinct from UnauthorizedAccessException, which we reserve for missing
// or invalid credentials and which maps to HTTP 401.
public sealed class ForbiddenAccessException : Exception
{
    public ForbiddenAccessException(string message) : base(message) { }
}
