Legal Authority, Liability and Use of Force
Two sources of authority
Security officers rely on the same citizen powers as anyone else: self-defense, defense of others, prevention of a breach of the peace, and - where state law allows - citizen's arrest or the shopkeeper's privilege for retail theft. That privilege is narrow: reasonable grounds, a reasonable time and manner of detention, and a prompt handoff to police. A detention that is too long, too forceful, or based on a hunch becomes false imprisonment or assault.
Use of force
Force must be necessary, proportional, and must stop when resistance stops. Think of a continuum - presence, verbal direction, soft empty-hand control, hard empty-hand control, intermediate weapons, deadly force - escalating only as the threat escalates and de-escalating as it drops. Deadly force is generally limited to defending against an imminent threat of death or serious bodily injury.
Liability
Officers and employers face civil claims such as negligence, false imprisonment, battery, and defamation, and rarely criminal exposure. Respondeat superior makes employers liable for acts within the scope of employment; acting outside policy increases the officer's personal risk and may remove employer protection.
Traps
'Miranda applies to me' - generally not; it binds government agents. 'I can search anyone on my property' - not without consent, contract-based conditions of entry, or a lawful exception. 'I have to press charges' - charging decisions belong to police and prosecutors.
Rule of thumb
Use the least force that safely achieves the lawful objective, and be able to articulate, step by step, why each increase was necessary.