The system level includes permissions that apply to generic system operations that do not concern a network, workspace, or device. The system level does not include any concrete resources, as it is meant for operations that are not related to networks, workspaces, or devices, and also for convenience as a fallback level during access control checks.
The network level includes permissions that apply to operations pertaining to a network, its sub-containers, and the devices within it.
The workspace level includes permissions that apply to operations pertaining to the workspace and design devices, including virtual devices.
The device level includes permissions that apply to operations pertaining to the device. Permissions explicitly assigned at this level trigger the Global Device Security Policy.