[wsrp-wsia] Question: what does an empty role list mean in an Entitydescription

Following up on today's discussion/decision concerning removing
UserContext from getServiceDescription(): This morning we said that a
consumer can determine if a user has access to an entity if the user is
in one of the roles declared in the entity's meta data description.  If
the role list is emtpty/null, what does this mean?  Does it mean that
everyone has access to this?  Or does it mean that no one has access to
this?  I presume/prefer the former but need clarification.
    -Mike-