Activating a menuitem produce an access rule record.
This error occurs in case the action defines some authorized groups while the groups that can view the menuitem is not a subset of the action's groups.
I propose to add a 'test_menu_action' helper to catch those in the unittests.
Doing it showed that a lot (if not all) configuration actions should have their groups value set.
The attached review begins fixing it.