Answer
Reproduce the error with the Debug Log Window open, and inspect the specific failing Requests it captures — the URL of each failed request identifies exactly which projection the client was trying to call when it got denied. Granting whichever specific projections show up in those failing request URLs (beyond the obviously-named ones you already granted) resolves the Attachment panel's permission error — this general technique (reproduce with Debug Log open, read the failing request URLs) is the reliable way to identify an obscure missing projection grant for any panel or feature, not just Attachments specifically.