jailshell miscellaneous - broken?

Hello,

Running WHM WHM 9.9.8 cPanel 9.9.8-C115.

I need to grant use on the 'at' command to a jailshelled user. at.allow is set, but the jailshell is preventing use of the at command.

On top of this, during exploration, I see that the jailshelled users can still navigate around the directory structure! Which is puzzling.

Two questions:

1) How do I fix this CPanel jailshell so that it roots the user in his/her directory

2) How do I grant extra commands to the jailshelled environment?

I am an old monkey, and can do these things easily on an unmanaged machine. I am afraid however to break this only CPanel server I have, which is a production machine. Experience appreciated.

Regards.
Alex