Inherited access can look inconsistent when a person belongs to several groups or when a child project has an explicit override.

Trace permissions from the top

Record the workspace role, group memberships, parent-project role, and child-project override in that order. The first unexpected value usually identifies the source.

Resolve without broadening access

Correct the narrowest rule that is wrong. Avoid granting a workspace-wide role to compensate for a single project problem.