I discovered another variant that causes the titular error message. I was copying the FIM policy config from one data source to another, and that meant making copies of a couple activities within the same workflow. After some troubleshooting and head-scratching, I realized that FIM was choking on the duplicate activity names (see highlights below). As you can see, when you build a workflow from the portal, FIM names all activities "authenticationGateActivityX." And interestingly, if you made the same mistake as I did, and you try to fix it by opening all of the activities within the portal and click "Save," FIM won't fix your mistakes!
<ns0:SequentialWorkflow
x:Name="SequentialWorkflow"
ActorId="00000000-0000-0000-0000-000000000000"
WorkflowDefinitionId="00000000-0000-0000-0000-000000000000"
RequestId="00000000-0000-0000-0000-000000000000"
TargetId="00000000-0000-0000-0000-000000000000"
xmlns:ns1="clr-namespace:IDMware.FIM.Workflow.Activities;Assembly=IDMware.FIM.Workflow, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b6cdb71f2a5e8e65"
xmlns:ns2="clr-namespace:FimExtensions.FimActivityLibrary;Assembly=FimExtensions.FimActivityLibrary, Version=2.0.0.0, Culture=neutral, PublicKeyToken=68dc29282b77eca9"
xmlns="http://schemas.microsoft.com/winfx/2006/xaml/workflow"
xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
xmlns:ns0="clr-namespace:Microsoft.ResourceManagement.Workflow.Activities;Assembly=Microsoft.ResourceManagement, Version=4.1.3559.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
<ns1:GenerateRandomPasswordActivity
x:Name="authenticationGateActivity1"
DestinationValue="{x:Null}"
MinPasswordLength="8"
DestinationString="RandomPassword"
TheActivityName="Generate random password"
MaxPasswordLength="10" />
<ns0:FunctionActivity
x:Name="authenticationGateActivity6"
FunctionExpression="<fn id="SingleValueAssignment" isCustomExpression="false"><arg>[//Target/AccountName]</arg></fn>"
Description="Grab Target account name"
Destination="[//WorkflowData/TargetAccountName]" />
<ns2:PowerShellActivity
x:Name="authenticationGateActivity5"
TheActivityName="Powershell: Set AD password"
PowerShellScript="C:\Scryptography\SetADPwd.ps1" />
<ns0:FunctionActivity
x:Name="authenticationGateActivity7"
FunctionExpression="<fn id="SingleValueAssignment" isCustomExpression="false"><arg>[//Target/LMSID]</arg></fn>"
Description="Grab LMS ID"
Destination="[//WorkflowData/LMSID]" />
<ns1:ExecuteSQLActivity
SQLStatement="EXECUTE [dbo].[SetLMSNewUserPassword] @id ,@password"x:Name="authenticationGateActivity8"
SQLConnectionStringName="LMS"
ParamData="<DocumentElement> <Parameters> <ParamName>@id</ParamName> <ParamValue>[//WorkflowData/LMSID]</ParamValue> <DataType>Integer</DataType> </Parameters> <Parameters> <ParamName>@password</ParamName> <ParamValue>[//WorkflowData/RandomPassword]</ParamValue> <DataType>String</DataType> </Parameters> </DocumentElement>"
WorkflowKey="Results"
TheActivityName="SQL: Set LMS password" />
<ns0:FunctionActivity
x:Name="authenticationGateActivity9"
FunctionExpression="<fn id="SingleValueAssignment" isCustomExpression="false"><arg>[//Target/VLMID]</arg></fn>"
Description="Grab VLM ID"
Destination="[//WorkflowData/VLMID]" />
<ns1:ExecuteSQLActivity
SQLStatement="EXECUTE [dbo].[SetVLMNewUserPassword] @id ,@password"
x:Name="authenticationGateActivity10"
SQLConnectionStringName="VLM"
ParamData="<DocumentElement> <Parameters> <ParamName>@id</ParamName> <ParamValue>[//WorkflowData/VLMID]</ParamValue> <DataType>String</DataType> </Parameters> <Parameters> <ParamName>@password</ParamName> <ParamValue>[//WorkflowData/RandomPassword]</ParamValue> <DataType>String</DataType> </Parameters> </DocumentElement>"
WorkflowKey="VLMResults"
TheActivityName="SQL: Set VLM password" />
<ns0:FunctionActivity
x:Name="authenticationGateActivity9"
FunctionExpression="<fn id="SingleValueAssignment" isCustomExpression="false"><arg>[//Target/PDSID]</arg></fn>"
Description="Grab PDS ID"
Destination="[//WorkflowData/PDSID]" />
<ns1:ExecuteSQLActivity
SQLStatement="EXECUTE [dbo].[SetPDSNewUserPassword] @id ,@password"
x:Name="authenticationGateActivity10"
SQLConnectionStringName="PDS"
ParamData="<DocumentElement> <Parameters> <ParamName>@id</ParamName> <ParamValue>[//WorkflowData/PDSID]</ParamValue> <DataType>String</DataType> </Parameters> <Parameters> <ParamName>@password</ParamName> <ParamValue>[//WorkflowData/RandomPassword]</ParamValue> <DataType>String</DataType> </Parameters> </DocumentElement>"
WorkflowKey="PDSResults"
TheActivityName="SQL: Set PDS password" />
<ns1:ExpressionEvaluator
x:Name="authenticationGateActivity4"
DestinationValue="False"
TheUpdateMode="0"
Notes=""
DestinationString="[//Target/SetPassword]"
ActorID="31415926-5358-9793-2384-626433832795"
ThisActivityName="Turn off SetPassword flag"
ValueType="String" />
</ns0:SequentialWorkflow>