How does 'login' change MCS Category Access?

[Josh <josh globalherald net>]

Hello,

On page 509 of the RHEL manual, there's a note that states: "MCS category 
access is assigned during login."

What is the mechanism that does this?

How can I assign MCS Category Access to an arbitrary Python script that is 
run as a certain user from Crontab (without being 'logged in')?

Thanks,
-Josh