Once set, a security context is locked. It can't request another security context.
This changes the way priority is calculated for processes in a vserver. The priority is kind of aglomerated. A vserver running 50 active processes will have a same impact on the server as if it was running a single process (roughly).
By default, all new vserver are created with S_FLAGS="lock".