Named CAL: Allows any named (as in defined in the QMC) user to access any application (security permitting of course!). Also allows licencing for QV Desktop
Session CAL: A pool of dynamic CALs that are consumed and released as people log in. You do not define them anywhere. They are like Concurrent licences so to speak. As with Named CALs there are no limits to the number of documents
If you only have these 2 CAL types the server will consume them in this order once a user clicks a document:
If the user has an allocated Named CAL already use that
If "Dynamic CAL Assignment" is switched on for Named CALs and there some remaining Named CALs free then allocate them one of these CALs. They will keep this CAL forever (unless you delete it)
If they couldn't get a Named CAL look in the Session CAL pool. If any are free then give them one of the CALs. If they log out, once the predefined limit is reached the CAL would be freed up and returned to the pool for other users to use
If they were unable to get a Session CAL then they will be denied due to no licences available
I would like to correct one point I see in your last post (Point 2). CALs should never ever be used for Security. CALs are for licencing only. If you need security (as in authorisation) you should use NTFS or DMS.