Ha, it won't predict it, but it should show you the 403 from a missing role assignment on your laptop instead of in your real subscription. If you try it with the azurerm provider, I'd love to hear what breaks.