How does the filter work? Identity first? As in, do they access the data/activity first and stop when they realize the person is a citizen? Otherwise how do the

How does the filter work? Identity first? As in, do they access the data/activity first and stop when they realize the person is a citizen? Otherwise how do they approach it?