On a Jenkins instance with Build Failure Analyzer and Matrix Auth plugins installed, it appears that Jenkins will error out if you try to set a permission involving the Build Failure Analyzer plugin's permission group.

Upon further investigation, it appears that PermissionFinder.findPermissionId() returns null when given a permission string such as Build Failure Analyzer/ViewCauses (which should be a correct string according to the UI). Perhaps the space in the permission group name is giving some pause?