Authorisation problems

Since migrating to RTC3 we are seeing increasing numbers of problems where a user is unable to access something, particularly when using the WebUI. The user receives message CRJAZ1484I and the server logs message CRJAZ1163I but there is nothing that gives any clear pointer to the cause of the problem or what we need to do to fix it. How can I work out whether any particular user should/shouldn't be allowed to carry out some action? Is there a set of checks that I can work through?
If not, can somebody please write a tech-note that will explain this.