Why does a Fiori user need both a front-end and a back-end PFCG role?

A user sees an app's tile in the launchpad, but the app fails to start. Which authorization layer is missing?

For a user to read KPI data in an analytical app, where must the app-specific roles be granted?

What is the first step when setting up front-end roles from SAP's delivered templates?

What must happen to an app's OData service before you can assign its start authorizations?

In which systems must a Fiori user exist when all three classic app types are used, and what helps keep the users in sync?

How does an app become visible to a user in the SAP Fiori launchpad?