Cloudkit error creating record: Error fetching auth tokens from server

When trying to create a record in Cloudkit, I have a user seeing this error:
Code Block
Error fetching auth tokens from server: Operation not permitted

with the underlying error being
Code Block
<CKError 0x2832825e0: "Permission Failure" (2007); server message = "Operation not permitted"; uuid = F01AC787-4B16-415D-BB3E-8D4E9AF62288; container ID =***>

iCloud has been authenticated and I confirmed that iCloud is enabled for the app.

I've seen versions of this error when iCloud isn't authenticated, but have never seen the "error fetching auth tokens" bit. Any ideas?
Cloudkit error creating record: Error fetching auth tokens from server
 
 
Q