Change 'security omitted' to mean 'no info'

Author: rvedotrc

versions/3.1.1.md

@@ -322,11 +322,13 @@ This object MAY be extended with [Specification Extensions](#specification-exten
 
 ###### <a name="oas-security-field"></a>The `security` field
 
-The `security` field describes how requests are authorized. If omitted, then requests are always authorized; otherwise, it is an array of security requirement objects, only one of which needs to be satisfied for the request to be authorized.
+The `security` field describes how requests are authorized:
 
-Because the empty [security requirement object](#security-requirement-object) `{}` will always authorize the request, it follows that `security: [{}]` means the same as omitting `security` entirely: namely, all requests are authorized.
+- If omitted, then nothing can be inferred about the authorization requirements; the behaviour is implementation-defined.
+- If present but empty (`security: []`), then the behaviour is undefined.
+- Otherwise, it is an array of security requirement objects, only one of which needs to be satisfied for the request to be authorized.
 
-If `security` is specified and empty (i.e. `security: []`), then the behaviour is undefined.
+Because the empty [security requirement object](#security-requirement-object) `{}` will always be satisfied, any `security` list of Security Requirement Objects that includes `{}` will allow all requests. In particular, `security: [{}]` means that no security schemes are in use (also known as "no security").
 
 Individual operations [can override this field](#operation-security).
 
@@ -3917,8 +3919,6 @@ This enables support for scenarios where multiple query parameters or HTTP heade
 
 When a non-empty list of Security Requirement Objects is defined on the [OpenAPI Object](#openapi-object) or [Operation Object](#operation-object), only one of the Security Requirement Objects in the list needs to be satisfied to authorize the request; see [the `security` field](#oas-security-field).
 
-The empty Security Requirement Object (`{}`) will always be satisifed, therefore any `security` list of Security Requirement Objects that includes `{}` will authorize all requests.
-
 ##### Patterned Fields
 
 | Field Pattern                                 |    Type    | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |