diff --git a/server/directives.go b/server/directives.go
index 26135b47d670dd27728199a041f7482a54838466..6740674e3074bfd64629d7cb8073cf1029b001dd 100644
--- a/server/directives.go
+++ b/server/directives.go
@@ -64,9 +64,10 @@ 			return nil, fmt.Errorf("Access to read/write resolver denied for webhook")
 		}
 		fallthrough
 	case auth.AUTH_OAUTH2:
-		if authctx.Grants.Has(scope, kind) {
-			return next(ctx)
+		if !authctx.Grants.Has(scope, kind) {
+			return nil, fmt.Errorf("Access denied, missing %v:%v grant", scope, kind)
 		}
+		return next(ctx)
 	case auth.AUTH_ANON_INTERNAL:
 		return nil, fmt.Errorf("Access denied for internal anonymous auth")
 	default: