I'm developing an application and I'm using a "service" tier between my controllers and repositories to perform model/business validations. Since this is a multi-tenant application (with shared database) I need to perform permission validations on all operations.

One thing that I'm unsure how to handle is return types in case a user has no access to a specific operation. For example, say I have a method `GetAccountById`. Normally this method would return an instance of an `Account` entity (or `null` if one doesn't exist). What would the appropriate return value be in case where the account does exist, but the current user doesn't have access to it? I don't really want to throw an exception, as it doesn't seem like a good use for one. So the question is: how do I alert the consumer of my service tier (be it a controller or a web service) that the authorization is not valid? Should I just create some kind of a `GetAccountByIdResult` type and include the outcome of the function in there (including any "error" codes, actual entity etc.)?

Thanks,