consider reviewing the following roles
SAP_GRAC_ACCESS_REQUESTER Role for End user
SAP_GRAC_BASE Base Role for all Access Control Users
SAP_GRAC_END_USER End User as a GRC Guest User
SAP_GRC_WEBSERVICE GRC Base Netweaver authorizations
If not, run the trace and identify the authorizations