Deploy tokens keep every role you select
A deploy token created with both roles ticked lost its workload role, so every deploy with it was refused with "Insufficient permissions". New tokens keep every role you select. If you have a token affected by this, create a new one.
When you create a deploy token in the portal, you choose its roles: workload to deploy sites, release to publish releases, or both.
Ticking both boxes didn’t work. Only the last role reached the token, so it could publish releases but not deploy. The token still looked active, and every deploy with it failed with:
403 {"error":"Insufficient permissions"}Tokens created with a single role were never affected, including tokens created with the default setting.
New tokens now keep every role you select, and a token can no longer be created with no roles at all.
Tokens created before the fix are unchanged. If a token you created with both roles gets this error, create a new one in the portal (Workload → Deploy Tokens) and replace the old token wherever you use it.