@ahv, @edwardcox :
Please give me the ACL's of users that you speak about.
Because sometime you give access, BUT another ACL is forbidding the access, so when it is merged, you lost the ACL authorization.
Please always copy the list of ACL's for the users you speak about.
(And remember that for the moment in sandbox, the configuration is reseted when you regenerate)
In sandbox :
The current ACL is viewable in the tooltip icon, next to the virtual user selectbox.
In your localhost, or production, try to insert theses lines in the template file :
<?php echo("<pre>"); print_r($this->access); echo("</pre>"); ?>
And let' see if you still have the problem.