How do you troubleshoot a permission denied error accessing a screen?

Start by identifying exactly which permission the screen or its underlying service requires - check the security element on the relevant controller.xml request, or the permission check inside the service definition being invoked.

1. Look up the user's UserLogin in WebTools and list their UserLoginSecurityGroup memberships.
2. Cross-reference each group's SecurityGroupPermission rows against the specific permission the screen or service requires.
3. If the check is owner-based rather than group-based (an order the user should be able to view because it's theirs), confirm the party relationship the check relies on is actually correctly linked, since a missing PartyRole or relationship is a common cause of "should have access but doesn't."
4. Temporarily add the user to a broader group like FULLADMIN in a non-production environment to confirm the diagnosis, then grant only the specific missing permission instead of leaving the broad grant in place.

Application logs will also show the exact permission string that failed, which is the fastest way to know precisely what to add rather than guessing.