Unauthorized mutation fails siltently

It seems that when you try to addType something that you’r not authorized to add, the GraphQL endpoint simply returns null not an error. Is this expected behaviour?