Replication endpoints/rules question

In the docs it states:

> If the namespace does not exist in the destination registry, a new namespace is created automatically. If it already exists and the user account that is configured in the replication policy does not have write privileges in it, the process fails. Member information is not replicated.

how does it determine which credentials are needed for the artifacts that come over?

I ask because the values of the harbor helm chart, under registry have, for example:

```
credentials:
username: "user"
password: "password"
```

but thats not working when I try to pull after a replication. I tried the admin creds, and that worked. What determines which creds it gets?