fix LOCAL limitation

docs/admin-guide/configuration/access/system_access.md

@@ -10,10 +10,10 @@ aaa::users:
 ```
 Groups are allowed with the `%` prefix in front of the group name.
 
-To limit a login to the physical desktop/console only you can add a `:LOCAL` suffix like this:
+To limit a login to the physical desktop/console only you can add an full [access.conf](https://man7.org/linux/man-pages/man5/access.conf.5.html) line with a `LOCAL` restriction like this:
 ```
 aaa::users:
-  - 'muster_h:LOCAL'
+  - '+:muster_h:LOCAL'
 ```
 
 Note that administrative users (see below) always have normal access without being explicitely listed in `aaa::users`.