Update privileges are applied at the next launch of the process. If this a service type of process, you may need to restart the process for the updater privileges to take effect.
i have exacly the same issue.
Kindly check if the cli is lockdown on the endpoint.
Also kindly share the MAC version you being used.
I using version 6.1.3 for windows
initial policy working ok.
when i add or delete any object from updaters list, this is not applied on end stations
other sections (publishers or binary) working ok.