User will get all features. Be careful what you ask for, you will get everything.

I was hoping the same but looks like it was either or in my testing .. i.e. I added the user to second group and on console was able to see the added feature available . But when I logged in back after some time , the added feature was gone. Basically , user is part of two groups , one group doesn’t have any feature enabled. Other group gives access to view historic password .

You must be careful, it can also depend on how your appliances are set up. 

In my environment, we have 3 appliances. The admin appliance, and two user appliances. 

When I first deployed BT, I had an issue just like yours. Services would show up and disappear at random.

What was happening was, when the load balancer pointed me to the end user appliances, admin features would not show up, things like Account Management, etc. but when I hit the admin appliance, the icons where present.

My solution, I placed the two end user appliances on the load balancer with a URL of something like https://users.vault.com and then the admin appliance was stand-alone and I had a separate URL for that.

If you are a cloud user, no appliances on premises, then this obviously isn’t your issue.

​@rhagerm omg , thank you so much for this!!!
At first I did not get why you were mentioning services , load balancer etc. and continued troubleshooting .. :-)  Now I realized the hard way, when I thought of generating logs and logged in to direct appliance UI (instead of load balancer) and thankfully I chose the management appliance. The feature was present for the user (which was not there like a minute ago when I launched via load-balanced URL) .
During my testing it would appear and vanish in different attempts. lol ..wasted several hours.. Thank you once again