Answer
Confirm the account has the baseline connection-level permission sets, not just the functional ones for the screens it needs — a couple of foundational permission sets are required just to establish a Cloud login at all, separate from whatever functional access the role otherwise needs, and missing them can look like a functional-permission problem when it's really a baseline-access one.