how to use "sql security"

[wangxu]

User_one create a procdure named "proc" with option "sql security invoker".
User_two only have "execute" privilege in the database that the "proc" in.
But the User_two still call the "proc".

What effect do the "sql security" option producing?