cts role-based enforcement

Hi, just trying to figure out cts role-based enforcement.  My understanding is that this is a required global config command for any L2 ports which need SGACLs applied - e.g. server 1 on vlan 10 needs restricted access (for whatever ports) to server 2 on vlan 10, so a SGACL would be needed at the L2 level (as both serves are on the same subnet/vlan), but without this command, the SGACL would not get applied?

Thanks

Dominic