What determines what someone can see, just their role?

Access requires both: your role must permit the action, and your organization's plan must include the underlying module. Missing access is almost always one of these two, not a bug, check both before assuming something's broken.