Each time you add a new resource (card or service), it will obtain a set of default permissions from a template stored in the LDAP directory. The template is created automatically the first time you add a new card or service, and can be modified in the Resource Assignment panel of the Privilege Management window (click HERE).

Templates are particularly useful for cards, allowing you to define the basic permissions for all roles for a certain card type. As new cards (of the same type) are added, they copy the permission set.