Three subjects, a user and two ServiceAccounts, send requests through the API server's gate. Keycard badges on the role cards show who holds which role. Pick who is asking and try an action, or press ▶ Guided tour.
Every request to the API server says who is asking: a user, or a pod using its ServiceAccount's token. RBAC decides what they may do: a Role lists verbs on resources in a namespace, a ClusterRole does so cluster-wide, and RoleBindings or ClusterRoleBindings grant roles to users, groups or ServiceAccounts. There are no deny rules. After RBAC, admission can still reject a request; Pod Security 'restricted' blocks privileged pods.