diff --git a/include/ircd/m/vm/fault.h b/include/ircd/m/vm/fault.h
index c7e8c9cbe..fde868c67 100644
--- a/include/ircd/m/vm/fault.h
+++ b/include/ircd/m/vm/fault.h
@@ -40,4 +40,5 @@ enum ircd::m::vm::fault
 	EVENT        = 0x0020,  ///< Eval requires addl events in the ef register. (#ef)
 	BOUNCE       = 0x0040,  ///< The event is not needed at this time. (#bo)
 	DONOTWANT    = 0x0080,  ///< The event will never be needed (cache this). (#dw)
+	DENIED       = 0x0100,  ///< Access of evaluator insufficient. (#ad)
 };
diff --git a/matrix/vm.cc b/matrix/vm.cc
index 2fa6e7377..2e846a47b 100644
--- a/matrix/vm.cc
+++ b/matrix/vm.cc
@@ -159,6 +159,7 @@ ircd::m::vm::http_code(const fault &code)
 		case fault::EVENT:        return http::NOT_FOUND;
 		case fault::BOUNCE:       break;
 		case fault::DONOTWANT:    break;
+		case fault::DENIED:       return http::FORBIDDEN;
 	}
 
 	return http::INTERNAL_SERVER_ERROR;
@@ -178,6 +179,7 @@ ircd::m::vm::reflect(const enum fault &code)
 		case fault::STATE:        return "#STATE";
 		case fault::BOUNCE:       return "#BOUNCE";
 		case fault::DONOTWANT:    return "#DONOTWANT";
+		case fault::DENIED:       return "#DENIED";
 	}
 
 	return "??????";
diff --git a/modules/m_room_server_acl.cc b/modules/m_room_server_acl.cc
index fdbc225cc..59c7dce16 100644
--- a/modules/m_room_server_acl.cc
+++ b/modules/m_room_server_acl.cc
@@ -44,8 +44,9 @@ ircd::m::on_check_room_server_acl(const event &event,
 		return;
 
 	if(!m::room::server_acl::check(at<"room_id"_>(event), at<"origin"_>(event)))
-		throw m::ACCESS_DENIED
+		throw vm::error
 		{
+			vm::fault::DENIED,
 			"Server '%s' denied by room %s access control list.",
 			at<"origin"_>(event),
 			at<"room_id"_>(event),