New User With No Role Has Full Access

[blueprint]

*NOTE* This may or may not be a bug...

I've just tested this now while adding a `training` user for internal training purposes.

I created a new User account but I forgot to assign them a Role. When I logged in as this User, they had full access to the entire EspoCRM system.

Should it not be that any new User who is not bound to a Role should have ZERO access to anything other than super-basic details?

[yuri]

https://github.com/espocrm/documentation/blob/master/docs/administration/roles-management.md#permissions-by-default