From the 'Accounts' section of the docs:
Currently there are three flags, used by issuers of assets.
Authorization required (0x1):
Requires the issuing account to give other accounts permission before they can hold the issuing account’s credit.
Authorization revocable (0x2):
Allows the issuing account to revoke its credit held by other accounts.
Authorization immutable (0x4):
If this is set then none of the authorization flags can be set and the account can never be deleted.
In what ways do you see this evolving over time (if at all)?