Concealing records

When policy hides a record from a caller, saying "forbidden" would reveal that it exists. So a hidden record fails with the same not_found failure your code already maps, and the client can't tell hidden from absent.

Say policy lets only a todo's owner read it. Then this read of someone else's todo fails with TodoNotFound, exactly like a todo that doesn't exist:

var todo: Todo = attempt Todo.get(todo_id)

The log adds concealed_by: policy, so you can still tell the two apart (When policy says no).