What the? I've got a RESTlet reporting

INSUFFICIENT_PERMISSION

to create a custom record. However, when I log in through the browser using the same user AND role as that restlet, I have no issues.