The user's browser follows the link, contacts the site, and requests the resource. Web resources protected by Shibboleth are called Service Providers (SPs). The SP can't make any authorisation decisions because it knows nothing about this user.
