diff --git a/crate/server/src/routes/google_cse/jwt.rs b/crate/server/src/routes/google_cse/jwt.rs
index 401497555..ac1633878 100644
--- a/crate/server/src/routes/google_cse/jwt.rs
+++ b/crate/server/src/routes/google_cse/jwt.rs
@@ -207,7 +207,9 @@ pub(crate) async fn validate_tokens(
         kms_ensure!(
             roles.contains(&role.as_str()),
             KmsError::Unauthorized(
-                "Authorization token should contain a role of writer or owner".to_string()
+                "Authorization token should contain a role of writer,  upgrader (for encryption) \
+                 or reader (for decryption)"
+                    .to_string()
             )
         );
     }