I was under the impression that the permissions only kicked in once you were in 32-bit mode on the 386, what Windows called "386 Enhanced" mode.

Any protected mode (if enabled). It was introduced with the 286.

The operating system/DOS extender could choose to let tasks (programs) run with the highest privileges, which would turn off some of the checks but not all of them -- you still needed valid selectors into valid slots in the descriptor tables.

If I'm not mistaken 286's protected mode wasn't really that popular because it breaks real mode DOS programs. Meanwhile, 386's 32-bit protected mode with paging and virtual 8086 mode was a big success.