One of the basic assumptions of the X protocol is that if a client can name an object, then it can manipulate that object. GLX introduces the notion of an Address Space. A GLX rendering context cannot be used outside of the address space in which it exists.
In a classic UNIX environment, each process is in its own address space. In a multi-threaded environment, each of the threads will share a virtual address space which references a common data region.
A OpenGL client that is rendering to a graphics engine directly connected to the executing CPU may avoid passing the tokens through the X server. This generalization is made for performance reasons. The model described here specifically allows for such optimizations, but does not mandate that any implementation support it.
When direct rendering is occurring, the address space of the renderer is that of the direct process and not that of the X server. The client has the ability to reject the use of direct rendering, but there may be a performance penalty in doing so. Direct rendering contexts can only be used within the same address space in which they were created.
When direct rendering is not being used, the address space of the renderer is that of the X server. Hence, all indirect renderers created with the same server may potentially be used by any X client of that server.