Error 400 on SERVER: Permission denied.

[Sandy]

Note - a puppet newbie here - any help is much appreciated :-)

We are getting a "Failed to generate additional resources using
'eval_generate': Error 400 on SERVER: Permission denied" whenever a file
being accessed/referenced via the file resource (directive) "recurse =
remote" function is not world readable on the puppet master. It does not
appear to be a file owner/group thing - it appears that all files within
the source tree actually require file level accessibility to be world
readable (004 mask) on the master so to deploy the file within a recursive
block to a node without the above error. This is on PE 3.7.2 CentOS 6.8.
Is this a bug? Is this a configuration setting? The thing is that this is
a blocker for us - we would like to deploy a directory tree but the world
permissions cannot have read access on the node once deployed.
huh?
Thanks in advance!