ahhh! that was it - the role I created for TBA access didn't have the subsidiary I needed! thanks @battk