AuthorizationRightSet() failing to add a right

Hi all,

firstly, happy new year to those of you using NSGregorianCalendar :)

I'm having trouble with AuthorizationRightSet never adding a right. I'm creating an AuthorizationRef, and passing that ref to AuthorizationRightSet(), but it always returns -60005 (errAuthorizationDenied). The sample in TN2095[*] doesn't show any other step necessary, but even if I ensure that my process has the right "config.add.<MyRight>" then I can't add the right. It doesn't work as a regular user, administrator or root, though the authorization db implies that anyone can add a right (i.e. the rule for "config.add." is "allow", unsurprising as the db is in its default state). Does anyone know what I'm missing to have the ability to add a right to the authorization DB with AuthorizationRightSet()?

Here's my code:

        AuthorizationRef auth = NULL;
        authResult = AuthorizationCreate(NULL,
                                         kAuthorizationEmptyEnvironment,
                                         kAuthorizationFlagDefaults,
                                         &auth);
        if (errAuthorizationSuccess != authResult) {
            NSLog(@"couldn't create authorization object, error %d", authResult);
            exit(-1);
        }
        //ensure we have the right to add the right
        AuthorizationItem item = { 0 };
        item.name = "config.add." kRightName;
        item.valueLength = 0;
        item.value = NULL;
        item.flags = 0;
        AuthorizationRights requestedRights;
        requestedRights.count = 1;
        requestedRights.items = &item;
        authResult = AuthorizationCopyRights(auth,
                                             &requestedRights,
                                             NULL,
                                             kAuthorizationFlagDefaults | 
                                             kAuthorizationFlagInteractionAllowed |
                                             kAuthorizationFlagExtendRights,
                                             NULL);
        if (errAuthorizationSuccess != authResult) {
            NSLog(@"don't have the right to modify the authorization database");
            exit(-1);
        }
        authResult = AuthorizationRightSet(auth,
                                           kRightName,
                                           CFSTR(kAuthorizationRuleClassDeny),
                                           NULL,
                                           NULL,
                                           NULL);
        if (errAuthorizationSuccess != authResult) {
            NSLog(@"couldn't add the right, error %d", authResult);
        }
        AuthorizationFree(auth, kAuthorizationFlagDefaults);

Thanks for your help,
Graham.

[*] http://developer.apple.com/mac/library/technotes/tn2002/tn2095.html#TNTAG11