Default access control list for commands in the console

[tom]

I just wanted to check that in the absence of an explicit access control list 
for commands in the console, the default is to be to allow anyone access.
Can that be altered at all? Is there a way of providing a default access 
control list at all? Or do I have to make sure I provide one for each command 
scope that I create?