IBM i data and object authorities

I was just reviewing a presentation which was provided by Robin Tatum of
PowerTech. It included a simple model for securing applications and data;
beginning with excluding *public authority to application objects and data
- then granting more granular object and data authorities to specific user
profiles, user groups, and authorization lists according to needs.

I then reviewed authorities to objects and data in IBM i "Q" libraries to
get a feel for how IBM configures *public authorities, which varied from
object to object. IBM authority defaults appear to be quite specific.

It seems to me that a security administrator could muck up a system if they
were to change IBM's default authorities for IBM's objects and data. Does
anyone have an alternate view?

Nathan.