I guess we can have one or two (for basic and extended ACL) status codes that notify about access restriction. It can be used in nspcc-dev/neofs-s3-gw#328 to return correct status code (now it relies on message with access to operation * is denied by sub string).