We have an authentication activity that we're updating in the Code-Security class used for our SSO flow. In previous versions of Pega we had the "Allow invocation from browser" box under the Security tab checked, however now it will not let us save with error "When enabling invocation from the browser, activities should be secured with a privilege"

I created a custom privilege in the Code-Security class and followed all the steps here to assign it to our access group and set it in the activity: https://docs-previous.pega.com/security/86/setting-privilege-secure-activity

However during SSO we see this error:

InsufficientPrivileges:RuleExecutionDenied RULE-OBJ-ACTIVITY CODE-SECURITY [our-authentication-activity] #20241015T211604.767 GMT Missing Privileges:[Code-Security:OurCustomPrivilege], AccessGroup:OurAPP:Unauthenticated

Is there anything else we might be missing? Thanks for any help!