Security Controls

What controls visibility of a request in the drop down menu when you do create --> request?
Either a username, token or security group is added in the user access tab of the request.
What controls visibility of the yellow buttons in a request?
Either a username, token or security group is added to each workflow step.
Note: Don't use double quotes within the text of a workflow step since it will not recognise the text. You can use single quotes.