I've got a user boschrexroth. This user does not belong to a user group. The rights are restricted to the datalayer. But indeed, the user has a lot of more rights. To example he has access inside the landing page to the EtherCAT app (delete the configuration or change the EtherCAT state) or he can stop/start/reset the PLC!