Identifying why a user is experiencing problems is tiresome in BC, 365 knows the problem, but forces you to try identifying the specific permission set missing on that specific user through various methods. If errors could be logged on user level, accessible via Usercard - Actions - Other - Permission errors , showing the exact permission missing to perform the action the user tried to perform and perhaps even a "append permission to this user/security group" would greatly improve the building of proper permission sets.