A program working correctly with incorrect input isn't an exceptional case. "This endpoint cannot be accessed in a CORS improper way" is caught in the library/

A program working correctly with incorrect input isn't an exceptional case. "This endpoint cannot be accessed in a CORS improper way" is caught in the library/framework level and doesn't even touch my code - there's no exception for me to catch. Throwing a checked exception for no access rather than returning "false" from a library call because you passed in all upper case on case sensitive role check would be a decision that I wouldn't agree with. Another example would be "I want to see the sql generated by hibernate" - that's not exception throwing at all, its me trying to debug what the query is and why the performance is awful.