executeOne() raises an immediate policy exception if the object exists but can't be seen, which is less specific ("You can't see a service.") than the error we'll be able to raise ("You can't see the service you tried to bind to.") if we continue.

This pattern is sort of "executeOne(), but return null instead of raising a policy exception if the object exists and can't be seen". Possibly it should be more of a first-class part of the API like executeOneMaybeOrMaybeNot(). There's setRaisePolicyExceptions() but it has some weird behavior that makes it not quite the same, I think. This is relatively rare overall and I don't have a great name for it so I haven't gotten as far as actually adding it to the API.

Conceptually, it would also be kind of nice to differentiate more clearly between "invalid" and "restricted". The API currently makes this tough. An executeOneMaybe() could perhaps return some kind of object wrapping the result that had methods like isRestricted(), isNonexistent(), etc. But I'm not sure if we'd realistically write out all the branches of error messages every time. Still, it might be nice if we had the option more readily.