Ahh.
Dell had me trying defining WMSgroup + token in a policy itself for a previous issue last year. Still don’t understand how this works or what its for (Chicken and egg? How would clients even get them if they don’t already reside in the group)
Although they had since been removed it apparently needed a policy reset on that section due to upgrade.
Advanced -> Services -> WMS Settings , reset.
Now I can make changes / publish it.