When we pass a policy link to a person who don't have access rights, we should tell more instead of 404
It should be a 403 instead of a 404, and we should lead the user to the document where they can edit policy.