diff --git a/apps/provisioning/pkg/auth/session_access_checker.go b/apps/provisioning/pkg/auth/session_access_checker.go
index 8a6ca55dad6..27ea420959e 100644
--- a/apps/provisioning/pkg/auth/session_access_checker.go
+++ b/apps/provisioning/pkg/auth/session_access_checker.go
@@ -3,6 +3,7 @@ package auth
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -88,6 +89,5 @@ func (c *sessionAccessChecker) Check(ctx context.Context, req authlib.CheckReque
 		return nil // Fallback succeeded
 	}
 
-	return apierrors.NewForbidden(gr, req.Name, fmt.Errorf("permission denied"))
+	return apierrors.NewForbidden(gr, req.Name, fmt.Errorf("%s role is required", strings.ToLower(string(c.fallbackRole))))
 }
-
diff --git a/apps/provisioning/pkg/auth/session_access_checker_test.go b/apps/provisioning/pkg/auth/session_access_checker_test.go
index ac9411c993f..2375fcf7b5d 100644
--- a/apps/provisioning/pkg/auth/session_access_checker_test.go
+++ b/apps/provisioning/pkg/auth/session_access_checker_test.go
@@ -248,4 +248,3 @@ func TestSessionAccessChecker_FillsNamespace(t *testing.T) {
 	err := checker.Check(ctx, req, "")
 	require.NoError(t, err)
 }
-
diff --git a/apps/provisioning/pkg/auth/token_access_checker.go b/apps/provisioning/pkg/auth/token_access_checker.go
index 659a9905124..8339074468a 100644
--- a/apps/provisioning/pkg/auth/token_access_checker.go
+++ b/apps/provisioning/pkg/auth/token_access_checker.go
@@ -60,4 +60,3 @@ func (c *tokenAccessChecker) Check(ctx context.Context, req authlib.CheckRequest
 	}
 	return nil
 }
-
diff --git a/apps/provisioning/pkg/auth/token_access_checker_test.go b/apps/provisioning/pkg/auth/token_access_checker_test.go
index 03a83c75e7f..aa6184b3a0a 100644
--- a/apps/provisioning/pkg/auth/token_access_checker_test.go
+++ b/apps/provisioning/pkg/auth/token_access_checker_test.go
@@ -141,4 +141,3 @@ func (m *mockInnerAccessChecker) Check(_ context.Context, _ authlib.AuthInfo, _
 func (m *mockInnerAccessChecker) Compile(_ context.Context, _ authlib.AuthInfo, _ authlib.ListRequest) (authlib.ItemChecker, authlib.Zookie, error) {
 	return nil, nil, nil
 }
-
diff --git a/pkg/registry/apis/provisioning/register.go b/pkg/registry/apis/provisioning/register.go
index 3ce8185a713..ff29b948faa 100644
--- a/pkg/registry/apis/provisioning/register.go
+++ b/pkg/registry/apis/provisioning/register.go
@@ -630,7 +630,7 @@ func (b *APIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver.APIGroupI
 
 	// TODO: Add some logic so that the connectors can registered themselves and we don't have logic all over the place
 	storage[provisioning.RepositoryResourceInfo.StoragePath("test")] = NewTestConnector(b, repository.NewRepositoryTesterWithExistingChecker(repository.NewSimpleRepositoryTester(b.validator), b.VerifyAgainstExistingRepositories))
-	storage[provisioning.RepositoryResourceInfo.StoragePath("files")] = NewFilesConnector(b, b.parsers, b.clients, b.access)
+	storage[provisioning.RepositoryResourceInfo.StoragePath("files")] = NewFilesConnector(b, b.parsers, b.clients, b.accessWithAdmin)
 	storage[provisioning.RepositoryResourceInfo.StoragePath("refs")] = NewRefsConnector(b)
 	storage[provisioning.RepositoryResourceInfo.StoragePath("resources")] = &listConnector{
 		getter: b,