This bitmask specifies which privilege types (execute, read, write) the rule's action applies to. An admin combines it with hh3cRbacRuleAction to precisely scope a rule, for example permitting read but denying write on the same entity, though operations not supported by the target entity simply don't apply. For example, setting only the read bit on a permit rule for a feature grants view-only access without allowing configuration changes.