Thanks Barnaby, I may PR a logger statement there or something so that failure errors are at least logged.
No next step needed on the issue itself, I solved the tenancy issue with Ash.PlugHelpers.set_tenant in the router, this is picked up by AshAuth.
Thanks for your help 
