IDs that previously were able to use CiviCRM now get 'Access denied - You are not authorized to access this page.'. (i.e. /civicrm/dashboard) These Ids can log in to Drupal. I may have caused this with some Role permission changes. I've fiddled with many of the Role permissions to no avail. We use ACLs to limit access to contact records.
What's the necessary subset of Drupal Role permissions to gain access to CiviCRM?
Drupal 7.61 CiviCRM 5.9.0