off the top ideas: what status code does RLS deny access return? can you use a client side hook attached to this status code to show a custom message? do you need different error messages for each role / specific role / deny pairings? would developing "middleware" query / functions using supabase functions (either db or edge) provide the specificity you need to send custom error messages?