[exim] SMTP response on restricted alias

Hi, I'm looking for help:

I'm restricting certain aliases to certain mail addresses
only (since I'm giving up on educating users to use them
responsibly). I'm using a senders precondition on the
system_alises: router and the allow/deny functionality is
working fine (only addresses in /etc/alias-restrictions/<foo>
are allowed to send to alias <foo>):

system_aliases:
    driver = redirect
    allow_fail
    allow_defer
    senders = ${if exists {/etc/alias-restrictions/$local_part}\
               {lsearch;/etc/alias-restrictions/$local_part}{*}}
    file_transport = address_file
    pipe_transport = address_pipe

My only problem is that if an alias is restricted, and you're
not on the allow list, you get an 'unknown user' SMTP response.

How can I add a 'not authorized to send to $local_part' SMTP
response? I suspect I'll have to split it into another router.

Another problem that has arisen (discovered when I couldn't
post to this list!) is that somehow this senders precondition
is causing exim to answer with a 550 to a null MAIL FROM:
address. Why would that be?

Thanks.

-- 
Illtud Daniel                                 illtud.daniel@???
Uwch Ddadansoddwr Systemau                       Senior Systems Analyst
Llyfrgell Genedlaethol Cymru                  National Library of Wales
Yn siarad drosof fy hun, nid LlGC   -  Speaking personally, not for NLW