A resource also has settings, available in the web interface using the resource's login. When I restrict the list of users which can invite the resource (in the calendar settings), this does not seem to get respected. Or, it gets respected in the sense that the request is ignored. Instead, the request should be denied, IMHO. For me, this would be the natural way to restrict access to a resource.
BTW: How do I see in the web interface whether the resource request was successful? I can see it from my client application (iCal), but I looked high and low in the web interface, to no avail.