The 401 vs 403 mapping is the cleanest way to keep the two straight. The ownership point deserves the extra emphasis: a role check like "is a student" still lets one student read another's result, so ownership has to be enforced per resource, not only per role.