To resolve this, the user's account will need to have access to the appropriate origins. Here is a procedure to do this:
1. Open the UMP Account Admin portlet and look at the account used by the user who is creating the dynamic group. Make sure that the account has access to all of the Origins that are associated with the machines,
2. Ensure that the machines in CM_COMPUTER_SYSTEM have the correct 'Origin' field populated.
3. Create a new ACL which has the same permissions as the ACL being used by this user account.
4. Create a new account, (for instance "test_account"), give it access to the same origins as the original account,
5. Create a test user and assign that user to the newly-created ACL.
6. Check whether the problem persists when assigning this group to the test_account.
7. If the above works, it's recommended that the original account/users be deleted and recreated.