I thought it would be Sitecore Client Configuring, but apparently not.
EDIT: Following Yan's input I've looked at the Application > Content Editor > Ribbons > Strips > Configure > Item Clones security settings and my user role should be able to read the clone panel, through membership of the client authoring role. I've also explicitly given the role access to read and write there. Still no joy. I've tested by removing access to presentation and templates, and that works fine for removing panels, so I've got the right role and user and I'm setting security in the right place.
Unless anyone has a better idea this is looking like a support ticket...