What permissions / controls, if any, are there to control whether a user can query group, group member, recordtype, or user role?
If they are not a member of a group (role, group), can they query all groups or roles?
If they are not a top-level role, can they query all UserRoles?
If they are not assigned a record type, can they query all record types?