Users logged into the sys group on any workstation other than the master domain manager

user op ~cpu=$master group=sys

###########################################################
# APPLIES TO USERS LOGGED INTO THE SYS GROUP ON ANY
# WORKSTATION OTHER THAN THE MASTER DOMAIN MANAGER
user op  group=sys
begin
#  OBJECT     ATTRIBUTES       ACCESS CAPABILITIES
# ----------  ------------     ----------------------
job           cpu=$thiscpu + logon=@  + folder = /
                                + cpufolder = / access=@
job           cpu=$thiscpu + logon=root  + folder = /
                                + cpufolder = /
                               access=adddep,altpri,cancel,confirm,deldep,
                               release,reply,rerun,submit,use
job           cpu=$thiscpu ~ logon=root  + folder = /
                                + cpufolder = /
                               access=adddep,altpri,cancel,confirm,deldep,
                               release,reply,rerun,submit,use
schedule      cpu=$thiscpu  + folder = /  + cpufolder = /  access=@
resource      + folder = /           access=add,display,resource,use
runcygrp      name=@    + folder = /   access=add,delete,display,modify,use,list,unlock
prompt        + folder = /             access=add,display,reply,use
calendar      + folder = /             access=use
cpu           cpu=$thiscpu  + folder = /  access=console,fence,limit,
                               link,start,stop,unlink
parameter     name=@ ~ name=r@ + folder = /  access=@
wkldappl      name=@     + folder = /   access=add,delete,display,modify,list,unlock
lob           name=@           access=use
folder        name=/           access=@
end

###########################################################

This user definition applies to sys group users to whom definition (3) does not apply, which are those who are logged in on any workstation other than the master domain manager. They are given a set of access capabilities similar to those in definition (3). The exception is that access is restricted to objects on the user's login workstation ($thiscpu).