The documentation about rights is
https://docops.ca.com/ca-ppm/15-3/en/administration/configure-authentication-and-security/configure-user-accounts-and-ac…
The normal use of the OBS rights are similar to instance rights except that instead of a single instance the right is subjected to all instances associated with an OBS unit or the unit and eg descendant unit depending on the association mode.
The OBS rights can be give to an individual user or to a group or to an OBS unit.
A less frequent use is the last one where the rights are given to an OBS unit and any resource associated with that unit gets the right. The down side of that has been that a resource can only be associated to one unit in an OBS while a user can be a member of any number of units and have any number of rights assigned directly.