I know that a user's security class affects which forms he or she can open in Design Studio. But what exactly grants access to Design Studio itself?
Another note to add to the security, if you need to control who can access Design Studio one way is to put a "case" statement in the home.js (the one for Design Studio, not the main Portal) file to only allow the userids that you specify to sign into Design Studio otherwise, just as John stated, just about anyone with a valid id can sign in and use it.
Thanks!