https://gist.github.com/atuttle/be5ae3e9503a80b52d27
Here you can see the event XML for 2 events. The second started as a copy of the first, and the first works without issue. I've also included the security plugin config, which is my best guess as to why this is blocked -- but I don't see why. (neither event is listed in bypass, so if one doesn't work then the other shouldn't either) So more likely it's got nothing to do with this plugin.
The reason I think it might be related to the plugin is that in local dev I have the plugin commented out and the event works fine, but in production with the plugin enabled it's failing.
I searched the Mach-II framework code for "Nobody is authorized" but couldn't find any instances, so I'm at a loss for what to do next...
I admit I'm not super skilled at Mach-II; I only maintain a small handful of apps on it, and only started that recently.
Thanks for any help you can offer!
Adam