If you want to configure security using the base identity object for the user, you can use the ~# macro. This could be used to find a user when the identity has been configured to be a related object, like a department or a project. For example, if the identity consists of associated object(s), meaning the Relationship check box was selected for the identity and a Relationship field was selected, using ~# can be used to identify the base class. For example, you could have an Employee class that has a Name attribute selected in the Identity Attribute field. You could select the appropriate association class that would find the project(s) the employee is assigned to. The identity would then be determined by the project(s) the employee is working on, but ~# would find the employee to use for user group rights in the User Groups tab.
This macro is particularly useful when using Security Attribute Exclusions. You may provide rights to objects based on projects, teams, or some other relationship definition; however, you may wish to exclude individuals directly and this can be accomplished using ~#.
If no Relationship is setup for the Security Attribute Identity, ~# and ~Identity will represent the same identity object.