Technically, it have full access to cluster. The default behavior is it reads your kubeconfig file and access your cluster resources. Which means it will be having same level of access, that you as a user is having. So as a safety, it is best to use a user which only has the read permissions to your Kubernetes cluster.