The error [Bearer, Bearer error=“invalid_token”, error_description=“The signature is invalid”] makes me think it’s an issue with how UGS is getting the access token rather than the ACL setup on the Horde side.
That second GitHub change looks like it’s in a very related area so I can follow up with some of our devs next week to double check if it could potentially fix this issue.
If not we can further investigate why the token might be invalid as it’s something that has come up before.
But as Julian says, please do check the UGS logs just in case there is any other info that might be able to help us out here.