bluetooth.conf

<!-- This configuration file specifies the required security policies
     for Bluetooth core daemon to work. -->
<!-- Debian-compatible additions to https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/src/bluetooth.conf?h=5.49 -->

<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>

  <!-- ../system.conf have denied everything, so we just punch some holes -->

  <policy user="root">
    <allow own="org.bluez"/>
    <allow send_destination="org.bluez"/>
    <allow send_interface="org.bluez.Agent1"/>
    <allow send_interface="org.bluez.MediaEndpoint1"/>
    <allow send_interface="org.bluez.MediaPlayer1"/>
    <allow send_interface="org.bluez.Profile1"/>
    <allow send_interface="org.bluez.GattCharacteristic1"/>
    <allow send_interface="org.bluez.GattDescriptor1"/>
    <allow send_interface="org.bluez.LEAdvertisement1"/>
    <allow send_interface="org.freedesktop.DBus.ObjectManager"/>
    <allow send_interface="org.freedesktop.DBus.Properties"/>
  </policy>

  <policy at_console="true">
    <allow send_destination="org.bluez"/>
  </policy>

  <!-- allow users of bluetooth group to communicate with hcid -->
  <policy group="bluetooth">
    <allow send_destination="org.bluez"/>
  </policy>

  <!-- allow users of lp group (printing subsystem) to 
       communicate with bluetoothd -->
  <policy group="lp">
    <allow send_destination="org.bluez"/>
  </policy>

  <policy context="default">
    <deny send_destination="org.bluez"/>
  </policy>

</busconfig>

Need to add this section to /etc/dbus-1/system.d/bluetooth.conf when installing a new bluez version from source on the beaglebone.

  <!-- allow users of bluetooth group to communicate with hcid -->
  <policy group="bluetooth">
    <allow send_destination="org.bluez"/>
  </policy>

This section already exists in the debian-modified 5.43 version of bluez, which is packaged as part of the 9.5 debian beaglebone image.
Without including this policy section in updated bluez versions, launching bluetoothctl will still work, but attempting to show the controller will print a No default controller available error.
Another workaround is to launch with sudo bluetoothctl.
Included a few revisions of the bluetooth.conf file from both bluez and debian repos for version 5.43 and 5.49 in this gist history for diffing. Not sure why the debian 4.49 version is so different than bluez 4.49 though.