@@ -251,2 +261,3 @@
+			return nil, toStatusErr(err)
+		}
 	}
-

@@ -248,3 +254,3 @@
 	})
 	if err != nil {
-		return nil, toStatusErr(err)
+		// For `Head`` case `NoRuleFound` status doesn't mean yet that the request is not allowed.

@@ -248,3 +254,3 @@
 	})
 	if err != nil {
-		return nil, toStatusErr(err)
+		// For `Head`` case `NoRuleFound` status doesn't mean yet that the request is not allowed.

@@ -204,0 +206,4 @@
+	}
+}
+
+// nonAllowStatusError is returned by CheckAPE in the case if non-allow status returned by the chain router.

@@ -157,3 +157,3 @@
 	})
 	if err != nil {
-		return toStatusErr(err)
+		// For Get case `NoRuleFound` status doesn't mean yet that the request is not allowed.

@@ -158,2 +158,3 @@
 	if err != nil {
-		return toStatusErr(err)
+		// For Get case `NoRuleFound` status doesn't mean yet that the request is not allowed.
+		// Probably, the request may be allowed by specific attributes that coudln't be read on forward

@@ -157,3 +157,3 @@
 	})
 	if err != nil {
-		return toStatusErr(err)
+		// `Get` is checked by APE in both direction. The forward check is performed without the object header

@@ -248,3 +256,3 @@
 	})
 	if err != nil {
-		return nil, toStatusErr(err)
+		// `Head` is checked by APE in both direction. The forward check is performed without the object header

@@ -160,0 +162,4 @@
+		// specific object attributes that aren't retrieved yet. But still they can be retrieved
+		// on the backward check and the rule may match on the fully filled APE-request.
+		var statError nonAllowStatusError
+		if errors.As(err, &statError) && !statError.IsNoRuleFoundStatus() {