REST_Controller - limits & levels?

Can someone give me a brief explanation how the limits and levels features of the REST_Controller work?

Do you only set the level requirements manually inside individual controllers? Or are they something to do with the all_access column in auth_access?

Thanks.