def METHOD_NAME(self, xblock):
    """ How does the endpoint behave when the requester doesn't have proper permissions? """
    xblock.xmodule_runtime = Mock(user_is_staff=False)
    response = self.request(xblock, {'submission_uuid': 'meaningless-value'})
    self.assertEqual(response.status_code, 200)
    self.assertIn('You do not have permission to access ORA staff grading.', response.body.decode('UTF-8'))