Let me try and explain it in the context of Sling Authentication.
As of AEM6 there are changes in API to stop the abuse of AdministrativeResourceResolver which has been utilized by many developers to get admin resourceResolver without passing any credentials.
As this has been deprecated in AEM6 you need to call getServiceResourceResolver(..) and pass it with subservice name which is mapped to a user via ServiceUserMapper configuration.
e.g. a configuration for writeservice could be AEM-bundle:datawrite=datawriteuser. here we are saying that datawrite which is part of AEM-bundle is mapped to datawriteuser and the privilege available to this user is what will be used by datawrite service.
A Service can be composed of many subservice and those subservices will be mapped to different users quoting sling documentation mail transfer service can be composed of smtp, queue, deliver subsystem and these subsystem can be mapped to mta:smtp, mta:queue, mta:deliver users respectively.
Check these references:
inside Blog entry
Sling Authentication