It includes users, groups, content and discussions. Essentially anything with a visibility. However, for users you can't have "indirect access" in this sense because you can't be provided access to a user VIA a group membership.