Hi John,
Did you run a trace(ST01) and check the missing authorization. Are you getting the same missing authorization in trace.
Also the Sales Order, for which the user is trying to check the Change document is it a valid one? I mean does it belong to any Sales org/division/..?
Cheers,
Laxman