Answer
Having the permission set that grants access to the lobby itself isn't the whole picture — that user also needs access to the underlying dataset (the company or site the lobby's data belongs to) and to the specific views or logical units the lobby's data sources actually query, so check both layers rather than assuming the permission set alone should be sufficient.