diff --git a/pkg/envoy/resource/rbac_rule.go b/pkg/envoy/resource/rbac_rule.go
index 8fa134784..5edbf61c2 100644
--- a/pkg/envoy/resource/rbac_rule.go
+++ b/pkg/envoy/resource/rbac_rule.go
@@ -62,6 +62,15 @@ func NewRbacRule(res *rbac.Rule, refRole, refRes *Ref, refResource string, refPa
 	return r
 }
 
+func (r *RbacRule) WrapError(act string, err error) error {
+	return fmt.Errorf("%s %s %v: %s",
+		act,
+		r.ResourceType(),
+		fmt.Sprintf("{ role: %s, resource: %s, operation: %s, access: %s }", r.RefRole.Identifiers.First(), r.RefResource, r.Res.Operation, r.Res.Access),
+		err,
+	)
+}
+
 func (r *RbacRule) Resource() interface{} {
 	return r.Res
 }
diff --git a/pkg/envoy/resource/types.go b/pkg/envoy/resource/types.go
index 4acabf550..9dac7afd5 100644
--- a/pkg/envoy/resource/types.go
+++ b/pkg/envoy/resource/types.go
@@ -16,6 +16,10 @@ type (
 		ReRef(old RefSet, new RefSet)
 	}
 
+	ErrorWrapper interface {
+		WrapError(act string, err error) error
+	}
+
 	InterfaceSet []Interface
 
 	IdentifiableInterface interface {
diff --git a/pkg/envoy/store/encoder.go b/pkg/envoy/store/encoder.go
index 0e793fc6b..6b2bd1b51 100644
--- a/pkg/envoy/store/encoder.go
+++ b/pkg/envoy/store/encoder.go
@@ -216,7 +216,13 @@ func (se *storeEncoder) makePayload(ctx context.Context, s store.Storer, dal dal
 }
 
 func (se *storeEncoder) WrapError(act string, res resource.Interface, err error) error {
-	return fmt.Errorf("store encoder %s %s %v: %s", act, res.ResourceType(), res.Identifiers().StringSlice(), err)
+	if ww, ok := res.(resource.ErrorWrapper); ok {
+		err = ww.WrapError(act, err)
+	} else {
+		err = fmt.Errorf("%s %s %v: %s", act, res.ResourceType(), res.Identifiers().StringSlice(), err)
+	}
+
+	return fmt.Errorf("store encoder %s", err)
 }
 
 func resourceErrIdentifierNotUnique(i string) error {
diff --git a/pkg/envoy/store/rbac_rule_marshal.go b/pkg/envoy/store/rbac_rule_marshal.go
index fe94c5055..8b350cb55 100644
--- a/pkg/envoy/store/rbac_rule_marshal.go
+++ b/pkg/envoy/store/rbac_rule_marshal.go
@@ -373,7 +373,7 @@ func (n *rbacRule) makeRBACResource(pl *payload) (string, error) {
 
 	// @todo if we wish to support rbac for external stuff, this needs to pass through.
 	//       this also requires some tweaks in the path ID thing.
-	return "", fmt.Errorf("unsupported resource type '%s' for RBAC store encode", n.rule.Resource)
+	return "", fmt.Errorf("unsupported resource type '%s' for RBAC store encode", rt)
 }
 
 func (n *rbacRule) handleComposeRecord(pp []resource.Interface) bool {
diff --git a/pkg/envoy/yaml/rbac_rules_unmarshal.go b/pkg/envoy/yaml/rbac_rules_unmarshal.go
index 124f40c46..a25fdfcd6 100644
--- a/pkg/envoy/yaml/rbac_rules_unmarshal.go
+++ b/pkg/envoy/yaml/rbac_rules_unmarshal.go
@@ -46,6 +46,7 @@ func (rr rbacRuleSet) decodeRbac(a rbac.Access, rules *yaml.Node) (oo rbacRuleSe
 				res: &rbac.Rule{
 					Access:    a,
 					Operation: op.Value,
+					Resource:  res,
 				},
 				refRole: resource.MakeRef(types.RoleResourceType, resource.MakeIdentifiers(roleRef)),
 			}