What level of access is granted to the service engineer?
You are always in control. The service engineer can access only the services you permit, which can be defined at a very granular (port) level. For example, you can restrict access to read-only to a particular directory. For more complex issues, the service engineer may request access to additional ports, like diagnostic services and databases, but you’re always in complete control of access.