It turns out I had an internal class GraphPermissionsImpl in GraphManager that was being used rather than the expected com.marklgoci.client.impl.GraphPermissionsImpl. The one in use had a bug and wasn't adding permissions, it was just overwriting them. So where this GraphPermissions object should contain two permissions, it only contained the last one:
graphMgr.permission("example_manager", Capability.READ)
.permission("example_manager", Capability.UPDATE)