"You are not an owner of account X" is not a permission the server is withholding; it is how far that identity can see. Answering it with "needs sysMaskedEmailGet" sends you off to grant something that changes nothing. A refusal that mentions ownership now says so, and says which account the run wants: the administrator with the run of the server, with tenant administrators passed as --tenant-admin.