diff --git a/server/src/error.rs b/server/src/error.rs
index 4d99cb4..8a60ae2 100644
--- a/server/src/error.rs
+++ b/server/src/error.rs
@@ -6,6 +6,9 @@ pub enum AppError {
     Unauthorized,
     BadRequest(String),
     NotFound(String),
+    /// 403 — authenticated but lacks permission (e.g. non-admin calling an
+    /// admin-only endpoint).
+    Forbidden(String),
     /// 409 — request is valid but conflicts with current state (e.g. an
     /// analysis is already running for this case).
     Conflict(String),
@@ -30,6 +33,7 @@ impl IntoResponse for AppError {
             Self::Unauthorized => (StatusCode::UNAUTHORIZED, "Unauthorized".to_owned()),
             Self::BadRequest(msg) => (StatusCode::BAD_REQUEST, msg.clone()),
             Self::NotFound(msg) => (StatusCode::NOT_FOUND, msg.clone()),
+            Self::Forbidden(msg) => (StatusCode::FORBIDDEN, msg.clone()),
             Self::Conflict(msg) => (StatusCode::CONFLICT, msg.clone()),
             Self::ServiceUnavailable(msg) => (StatusCode::SERVICE_UNAVAILABLE, msg.clone()),
             Self::Internal(msg) => (StatusCode::INTERNAL_SERVER_ERROR, msg.clone()),