Allow restricts the user to the selected clients (no Allow = full access). Deny blocks a client regardless of Allow. Admin users are unaffected.