If you click on the button from a role that has permission and then try open that same url with the role that doesn't have it, it will often give an error message with the exact role required