Identify where access is denied
- Record the exact page URL and the account role that sees the error.
- Test the same page as an administrator and as the intended user.
- Check page-level access rules and any CHKM8 page access component.
- Check whether an admin customisation, white-label or security plugin applies a separate restriction.
- Test direct URL access, not only menu navigation.
- Review security logs and server logs for the denied request.
Safe recovery
Do not disable every security plugin immediately. Change one identified rule at a time, preserve an administrator session, and test the exact affected page after each change. If a file is linked from the page, check file access separately.