What would be the benefit of a status of either 404 or 403? Is it for the purpose of supporting robots, providing an API, or something else? I think it'd actually be kind of weird to use either of these codes. In most Web applications, it's much more common to use status codes of 200 OK or 3xx redirects. For example, a status of 200 would be fine because the URI would load but simply display different information depending on a user's permission level. Alternatively, you could use a redirect to an index, a list, a search form, a create form, whatever.