Ah ha - I didn't even realize, but I think the Cartons page itself is a custom view we added. Which means I've probably got the permissions wrong on my side of things! Whoops!