SAREST is largely a reporting capability whereby the SAREST service responds to HTTP GET requests of certain patterns with the expected information.
SAREST will obey enterprise encyclopedia restrictions because it runs reports using the SAXT Reader report engine. It uses the name of the user that is currently logged in, or in the case of a remote request, the authentication supplied by the remote browser.
If the encyclopedia being accessed is non-enterprise then everything can be accessed.