I think the easiest way to figure out the permission is going to a journal entry on your admin account then copy the url then go to a role that doesn't have access and paste the url in