VPN Profile and Policies

Connection Profile (aka Tunnel Group) controls the "Pre-logoin Policy"

After login, ASA knows who the user is and post-login policies(permissions,authorizations,restrictions,etc) come. Top always win if there is conflict.

Example flow.