Thanks everyone.
The trace worked. I think the issue was auth object AI_LMDB_OB which is strange.
I forgot to say that this always USE TO WORK for users and suddenly stopped working one day (and the roles definitely hadn't changed). Anyway adding the above seemed to work.
B_SMAN_WPL was already ok (I had already checked this).
This is now resolved.
Cheers
Shaun