Noted, thank you (added to our ticket internally).
I can only apologise for this inconvenience to you and your users as we continue to look into it in more detail…
One workaround that seemed to work for some other apps was to have the user re-authenticate (thus, presumably, getting back a token with all three permissions again). That’s annoying, but it may help mitigate while we look at what is happening.