If a user is a member of more than one group that has authorizations on a safe, by default that user is granted____________________.