You'll notice
Read-rule denial messages now also mention sandbox settings as a possible cause.
The explanation shown when a sync is blocked by a Read rule now also covers the case where a sandbox read-deny setting is the cause, and likewise for cases where the rules can't be read.