Users logged into the sys group on any workstation other than the master domain manager

user op ~cpu=$master group=sys

###########################################################
# APPLIES TO USERS LOGGED INTO THE SYS GROUP ON ANY
# WORKSTATION OTHER THAN THE MASTER DOMAIN MANAGER
user op  group=sys
begin
#  OBJECT     ATTRIBUTES       ACCESS CAPABILITIES
# ----------  ------------     ----------------------
job           cpu=$thiscpu 
              + logon=@        access=@
job           cpu=$thiscpu 
              + logon=root     access=adddep,altpri,cancel,
                                      confirm,deldep,release,
                                      reply,rerun,submit,use
job           cpu=$thiscpu 
              ~ logon=root     access=adddep,altpri,cancel,
                                      confirm,deldep,release,
                                      reply,rerun,submit,use
schedule      cpu=$thiscpu     access=@
resource                       access=add,display,resource,use
runcygrp      name=@            access=add,delete,display,modify,use,list,unlock
prompt                         access=add,display,reply,use
calendar                       access=use
cpu           cpu=$thiscpu     access=console,fence,limit,
                                      link,start,stop,unlink
parameter     name=@ ~ name=r@ access=@

wkldappl      name=@            access=add,delete,display,modify,list,unlock
lob           name=@            access=use
end

###########################################################

This user definition applies to sys group users to whom definition (3) does not apply, which are those who are logged in on any workstation other than the master domain manager. They are given a set of access capabilities similar to those in definition (3). The exception is that access is restricted to objects on the user's login workstation ($thiscpu).