When Active Directory is used, does Visual Guard .Net modify Active Directory or simply access it and use data base tables for permission data?

Actually, Visual Guard .Net does not "use" Active Directory at runtime.
It gets the security Id of the current Windows account and it checks the permission in the repository (database). Visual Guard .Net stores only the Security Id of Windows Accounts in the repository.

Visual Guard .NET