There’s a simple solution to that. Always return 403, it’s what you should be doing regardless of your underlying data model. You should always be determine ri

There’s a simple solution to that. Always return 403, it’s what you should be doing regardless of your underlying data model. You should always be determine right to access a record before attempting to look it up. If you can’t determine ACLs without the lookup, then your permissions layer should always assume the requester doesn’t have permission to view a non-existent record and return a 403. Doing anything else is dangerous, and randomising PKs is a sticky plaster over a badly designed access control system.