You could subscribe to a single record or to an entire collection.
When you subscribe to a single record, the collection's ViewRule will be used to determine whether the subscriber has access to receive the event message.
When you subscribe to an entire collection, the collection's ListRule will be used to determine whether the subscriber has access to receive the event message.