The Security header block without a specific s:actor can be consumed by anyone, but must not be removed prior to the final destination as determined by WS-routing.
Example of the security header block:
Usually, if a header block does not have actor attribute specified, this block must be processed by the ultimate receiver, not anyone.
If the header block has been processed, it is usually removed.
Does the quote in MZ's noted contradict with what a header process usually does?