Is it possible he exists in more than one group? If so, then I suspect that his rights to connections are being granted on a “Most Restrictive Basis”. That is, if a feature is revoked from the user in one place, it’s gone everywhere.
See How are Rights Granted if a user is in Multiple Groups? from our Supervisor FAQ.
Anita Craig 
(BOB member since 2002-06-17)