Answer
If the action behind that button is actually implemented as a workflow (BPA) rather than a plain projection action, granting the projection/entity/action alone isn't enough — the workflow itself also needs to be granted in the permission set; a full-access-looking permission set can still be missing that separate workflow-level grant, which produces exactly this kind of unauthorized error despite projection permissions looking complete.