User will get all features. Be careful what you ask for, you will get everything.

I was hoping the same but looks like it was either or in my testing .. i.e. I added the user to second group and on console was able to see the added feature available . But when I logged in back after some time , the added feature was gone. Basically , user is part of two groups , one group doesn’t have any feature enabled. Other group gives access to view historic password .

You must be careful, it can also depend on how your appliances are set up. 

In my environment, we have 3 appliances. The admin appliance, and two user appliances. 

When I first deployed BT, I had an issue just like yours. Services would show up and disappear at random.

What was happening was, when the load balancer pointed me to the end user appliances, admin features would not show up, things like Account Management, etc. but when I hit the admin appliance, the icons where present.

My solution, I placed the two end user appliances on the load balancer with a URL of something like https://users.vault.com and then the admin appliance was stand-alone and I had a separate URL for that.

If you are a cloud user, no appliances on premises, then this obviously isn’t your issue.