I realise this thread is a few years old but as I found it while I was having the issue I thought I'd share.
With publisher, the document reduces by the access given to the service account user, before reducing for individual users.
That is, a service account user with access <ANY>|<ANY>, will reduce the entire document to this exact string, before attempting to reduce to ABC|XYZ. As ABC|XYZ doesn't exist any more (only <ANY>|<ANY> does), the access denied message is shown.
The simple solution is just to give the service account user blank access. I.e. an empty string, rather than <ANY>|<ANY>. This will mean all strings (i.e. no reduction) exist in the master app, so the reduction to ABC|XYZ will be allowed.
