This error message showing up when trying to start the machine headless:

VBoxHeadless: error: The object functionality is limited
VBoxHeadless: error: Details: code E_ACCESSDENIED (0x80070005), component Machine, interface IMachine, callee nsISupports
Context: "LockMachine(session, LockType_Write)" at line 866 of file VBoxHeadless.cpp

...but the machine will start fine from the GUI. Problem turned out to be that
one of the virtual disk files was owner = current user and group = root.
changing its group to one the current user was a member of fixed the problem.