Up to version 0.9.10
Authentication and User Levels
There are two types of setting to control auth. One is users, which are matched by hostmask. The other is the user's level. This determines which bot commands the user can run.
By default, all users (hostmask *!*@*) get a level of 10. The default level setup means that they can interact with the bot, add, modify and remove keywords, add and retreive quotes, and use most of the modules. However they can't tell rbot to quit IRC, join or part a channel, or insult another user via private message. This, believe me, is a good thing.
You can learn more about auth by messaging the bot with "help auth", but the important first step you need to take is to tell the bot you're its master. This gives you total access to all bot features, so long as you know the password set in conf.rbot. "/msg botname auth masterpasswd" will get you recognised. You can then add and remove other users, change their levels, and adjust the levels needed to run various features.
An example set of levels comes in rbot/levels.rbot. Levels are generally named after what they do, like "join", "quit", "say", etc. Some are more intricate, "keyword" means keyword retrieval, whereas "keycmd" refers to setting and modifying keywords. Plugins get protection via levels too, generally if a plugin registers itself to handle "foo <params>", the level for that plugin is set via "foo".
Versions 0.9.11 and following
A new authentication and user management system has been developed for the next versions of rbot: read all about it on NewAuthModule
