I think I know which option you want to enable, because I did the same for users.
It wasn't clear at first and I had to consult this with the support, but basically ensuring above 2 settings should be enough.
1. confirm on a given object user's access:
2. make sure users can see "hours" on a give...