The highest, most privileged level is 0 - a program running at this level can gain access to any 386 resource. Privilege levels are intimately tied to descriptors. As I mentioned, the descriptor contains the base address of a segment, the segment size, and access rights bits. Privileges are thus associated with segments, a somewhat novel concept when you consider that most CPUs simply have a global privilege setting that effects all of memory equally. Cleverly enough, this is handled entirely within the context of segment privileges.
Privileges are somewhat removed from the code, then.
An attempt to access a segment more privileged then the computer's CPL results in an exception, letting us know something is wrong. Thus, code running in a segment with a DPL of 0 pumps the CPU up to a CPL of 0, and gives the CPU access to every other segment. Novice 8086 assembly programmers always moan about the complexity of segments and segment groups. Perhaps the operating system will be grouped into one segment with a DPL of 0 so it can access any resource. Maybe device drivers can fit into a less important group, giving them just as much power as needed but no more, preventing them from trashing code.