The modes "Allow Execution" at 0x2 and "Query User" at 0x5 are both documented in the UEFI security spec.