You should read the iOS 5 Education Deployment Guide, and search/grok the info associated with the concept of the "Layered Ownership Model" put forth in that paper. For the perpetually lazy, like myself, see the quote below.
While a Personal Ownership deployment allows the individual to own all content and an
Institutional Ownership deployment allows the institution to retain ownership of all
content, the Layered Ownership deployment allows for both parties to own their
respective content on the same device.
The Layered Ownership model offers the end user full control over his or her content
while allowing the institution to retain ownership of purchased apps. This makes it an
excellent deployment strategy for all users age 13 and over.
Syncing with an institution’s iTunes account allows an organization to ensure that a
prescribed set of apps exists on all iOS devices. These apps are synced to a device that
has not yet completed iOS 5 Setup Assistant. Typically, the device is new or at factory
defaults and must be running iOS 5.0 or later.
The end user then uses his or her personal Apple ID to complete iOS 5 Setup Assistant,
which configures built-in apps and services to use the personal Apple ID, including a
personal iTunes account. The institution continues to manage apps from iTunes while
the end user manages personal apps and content directly on the device. In the Layered
Ownership model, the end user does not sync with any iTunes computer other than the
institution’s sync station.
Allowing end users to download personal apps and content is more likely to give them
a sense of ownership so they may be more apt to protect the iOS devices. This may be
helpful in a model where the devices are taken home, and the goal is to both guide and
empower the end users. It may also be preferred for iOS devices provided to instructors
and administrators.
It is not just applicable to educational institutions, but enterpises as well. Long story short, you have the admin server/technican workstation with Apple Configurator installed managing the deployed apps (through VPP or other means for paid apps). Users can make their own changes so long as they do not sync their account via iTunes on another computer. With the advent of on-device App Store and iCloud, this is by design now. I do not think it is a positive development, but that is the way they envision it.
Again, I recommend you read the PDF I link to. The information in it is quite useful for understanding what Apple expects of administering their devices, although I would appreciate more detailed scenarios instead of very summarized, eagle-eye views.