When the /sec/datum/mostRecent endpoint is invoked using a data security token whose security policy restricts the minimum aggregate level, the call will fail. This endpoint does not currently support requesting the "most recent datum at aggregate X" but perhaps it should, and then security tokens with an aggregate policy could still work, just returning the most recent aggregate data rather than the most recent raw data.