Link: https://learn.microsoft.com/en-us/power-bi/connect-data/desktop-directquery-about#security
The article mentions
DirectQuery allows for a report viewer's credentials to be passed through to the underlying source and security rules to be applied there. Single sign-on is supported to SQL Azure datasources, and through the data gateway to on-premises SQL servers.
This implies that report viewers credential is used to query underlying data.
Where as further down it contradicts this:
As discussed earlier in this article, a report in DirectQuery always uses the same fixed credentials to connect to the underlying data source, after it's published to the Power BI service. This behavior applies to DirectQuery, not to live connections to SQL Server Analysis Services, which is different in this respect. Immediately after publish of a DirectQuery report, it's necessary to configure the credentials of the user that will be used. Until you configure the credentials, opening the report on the Power BI service would result in an error.
Once the user credentials are provided, then those credentials will be used whichever user who opens the report. In this way, it's exactly like imported data. Every user sees the same data, unless row-level security has been defined as part of the report.
Does direct query connect to sql server using gateway credential or report viewer credentials?