I've just realized behaviour is also connection depended: There are some connections which can be queried as regular user and some can't. I still assume it should return no errror but haven't found a pattern triggering "permission denied".