diff --git a/crnk-security/src/main/java/io/crnk/security/internal/DataRoomMatcher.java b/crnk-security/src/main/java/io/crnk/security/internal/DataRoomMatcher.java
index <HASH>..<HASH> 100644
--- a/crnk-security/src/main/java/io/crnk/security/internal/DataRoomMatcher.java
+++ b/crnk-security/src/main/java/io/crnk/security/internal/DataRoomMatcher.java
@@ -50,7 +50,7 @@ public class DataRoomMatcher {
 	public void verifyMatch(Object resource, HttpMethod method, SecurityProvider securityProvider) {
 		boolean match = checkMatch(resource, method, securityProvider);
 		if (!match) {
-			LOGGER.error("dataroom prevented access to {} for {}", resource, method);
+			LOGGER.warn("dataroom prevented access to {} for {}", resource, method);
 			throw new ForbiddenException("not allowed to access resource");
 		}
 	}
reduce log level of dataroom filter to WARN

align with WARN for ForbiddenException (as any 4xx error)