Answer
Check whether the user is missing a grant to the 'Appearance Configuration Resource' page and the AppearanceConfiguration projection — granting both of these to the user is what resolves this specific post-login 'No Access' error. The confusing behavior around FULL permission set and browser cache is a caching side-effect of how that specific denied resource gets probed and cached client-side on login, not a sign that a broader FULL grant is actually required — once the correct AppearanceConfiguration grant is in place, the error goes away without needing FULL access at all.