Folded into each user's permissions while the config is parsed, so it only affects users with no explicit permissions; from there it follows the users path and is re-applied to live client connections. Not re-applied to existing leafnode connections.