4409 error after setting up Kerberos

We started receiving this error after switching from SP3 in single server configuration to SP4 in distributed simple configuration with Kerberos authentication when we try to update process instance data fields from our web page through K2ROM.

First version of our system had NTLM authentication, and users on the process had all the rights granted with the K2.NET Service Manager except Admin rights.

After moving to Kerberos authentication, user with the same rights is no more allowed to write data to process instance.
K2.NET authenticates the user, user can read data but when processInstance.Update() method is invoked K2.NET returns following error message:

4409 - DOMAINUserName from AAA.BBB.CCC.DDD does not have rights to Open Process PROCESSNAME(ID)

If we grant this user Admin rights through K2.NET Service Manager he is able to do the update.

I read in your manual about different levels of rights that can be granted, but I don't think I really understand it well.

Now my questions...

What does Admin right for a user really stand for in the context of specific process?
How can it be, that the same user before switching to Kerberos can do update without Admin rights, and later user needs Admin rights?
Is there any place where all error codes are listed with some kind of explanation?
If not, what does this specific error code mean?

And finally, should I grant all my users on a process Admin rights or is there something else I should do to fix this issue?

Thank you in advance for all your suggestions or explanations...