Security proerty in Service Manager

my understanding of the security is this:

 by default the security is wide-open...meaning that if there are no users defined then anyone with the service manager client can perform all functions (like deleting a processInstance or transferring a worklist item) as well as export processes to the k2 server. As soon as you enter a user into the security window it is locked down to whoever is in the list.  you can specify whether the user can perform exports or admin functions or both.