...
Taking the second line first, this specifies that any resource (not previously matched) requires that the user be (at least) an anonymous user, but because of the first line any request for a resource matching private.html require that the user be part of the ROLE_USERS group, which means that they'll have to login to get the the private client since the user must access private.html to get to the private clienbt client.
Obviously there is more to the first line than meets the eye. It turns out that this URL is interpreted by the server as being requests to load a specific client configuration (called private in the above example) from config.xml.
...