Você verificou se o usuário do apache está no arquivo at.allow? Per a página man ...
The /etc/at.allow and /etc/at.deny files determine which user can sub-
mit commands for later execution via at(1) or batch(1).
The format of the files is a list of usernames, one on each line.
Whitespace is not permitted.
The superuser may always use at.
If the file /etc/at.allow exists, only usernames mentioned in it are
allowed to use at.
If /etc/at.allow does not exist, /etc/at.deny is checked.