This way of passing the message seems fine, but I'd like to better understand why you're making this change.

It's all related to external user services, e.g. Bugzilla.  My other changes to Review Board have allowed extensions to shuttle user queries off to an external service; however, there's no way to report errors back to the user.  In particular, I'm concerned with a Bugzilla session expiring, which would silently cause user autocomplete to fail; in this case, I would want a helpful message to be displayed indicating that the user should log out and back in again to refresh thes session.  This change allows us to return specific failures up to the client (I have a separate patch for Review Board to display these errors, which will be posted for review soon).
Technically these errors don't really have to map to PERMISSION_DENIED, e.g. if Bugzilla is down.  That's why I was wondering if there should be a generic 500 error for query failures.  But I don't particularly care either way, since I can still return a specific error string.

So where does the PermissionDenied exception come from? Are you raising that yourself?
I'm thinking maybe instead of this very generic change to WebAPIResource, we might want to add more specific errors to the resources that can have extension-provided errors.

It comes from my backend's overridden AuthBackend.query_users() method, raised up through the web API UserResource.get_queryset().
Yeah, as I mentioned, I was thinking a QUERY_ERROR webapi.errors class (just realized we don't need a QueryError in another error class, since the error is originating from a WebAPIResource; that wasn't the case with the publish errors, which came from review model classes).

Hm, although it wouldn't be quite as elegant since webapi.error classes aren't exceptions, so we'd have to look at the type of the object returned by WebAPIResource._get_query_set(), unless we did actually create a QueryError exception class as well.  Just thinking out loud now. :)

Ahh sorry I misunderstood.  I'll give that a shot.