Where this subject's permissions land. Cluster-wide grants reach every namespace; namespace-scoped grants are listed individually. Grants that come from auto-membership virtual groups (system:authenticated, system:authenticated:oauth, system:serviceaccounts, system:serviceaccounts:<ns>) are folded into the collapsible blocks below — they apply to every authenticated principal on the cluster, not to this subject specifically.
Cluster-wide via system virtual groups(1)— shared with every authenticated principal
Each path is one (role, scope, group-membership) combination. Click Show rules to see the underlying API rules. 1 additional path via auto-membership virtual groups (system:authenticated et al.) is collapsed below — they grant the same access to every authenticated principal.