how rules applied to arunning processes after gradm -E ?

[hatereg]

i can understand well how rules applied to new processes, when grsecurity ACL system is enabled
(nice diagram from grsec 1.5 documentation pdf)

But: how rules do apply to processes that already run before executing gradm -E ?

for example i have mysql running as user mysql. I have in my policy file role mysql and ACLs for it.

what happens with role of mysql when i do 'gradm -E' ? Is it mysql? default?
does grsecurity checks command line of process to determine rules? or..?

thank you.