A cloud permission exists in one region while the recovery workflow executes in another scope during a failover rehearsal

The right grant is present and absent at the same time depending on where the workflow actually runs. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.