How does a BQE CORE user's subscription affect the security profile, and how does that work with access management (Settings > Access & Permissions > Manage Access)?
The CORE user's subscription determines which screens and features they have access to in CORE. Check CORE Help Center for details. So, the user can access those screens only. Then the security profile also controls the access to features and functions, but within the subscription of the user. Subscription and security go hand in hand, so no feature is available if only one of them permits it. In other words, if a user has Full Access security, but is subscribed to time and expense features only, the user won't be able to access anything outside the time and expense screens, even though other screens are visible. Check CORE Help Center for details.
On the other hand, Manage Access is a security feature, but it does not add or remove any screens from the user's access. It works in conjunction with the user's security profile to control access to projects, activity and expense items in various screens. In other words, it controls which projects, activity and expense items are visible to the user in various permitted screens. Check CORE Help Center for details.
If you limit access from the Manage Access screen for a user on a screen that the user's subscription or security permissions does not include, it will have no bearing on the user's access as that screen isn't visible in the first place. It will only have an effect if you apply it on a screen that the user has access to.