Firstly there is an option in the services.conf file so that ONLY IRC opers can use ChanServ:
# CSOpersOnly [OPTIONAL]
# If this is defined, only IRC Operators will be permitted to use ChanServ.
#CSOpersOnly
Secondly as far as i am aware only user with Services Admin access (on the OperServ ADMIN list) can create and remove BotServ bots. If you wish to prevent normal users from being able to assign a bit youve created you can use:
/msg BotServ set BOTNAME private on