drupal_set_message is visible only to those with permissions for the operation? API about drupal_set_message read:
"Set a message which reflects the status of the performed operation.
If the function is called with no arguments, this function returns all set messages without clearing them."

Does that mean, if the operation is not permitted for authenticated user or anonymous, then they cannot see the message but only visible to who has the permission to perform the operation?
No, it doesn't. It means that if you want to get the list of the messages set from other modules, you just call the function without any argument; this is what drupal_get_messages() does to get the list of messages set by the modules.

function drupal_get_messages($type = NULL, $clear_queue = TRUE) {
  if ($messages = drupal_set_message()) {
    if ($type) {
      // …
    }
    // …
  }
  // …
}


If the message should be visible to users with a specific role, it is the caller that needs to first check the user's permissions with user_access() as in the following code, executed from comment_form_submit():

  if (!user_access('administer comments')) {
    drupal_set_message(t('Your comment has been queued for review by site administrators and will be published after approval.'));
  }


This doesn't need to be done in a form submission handler, if who uses the form is already restricted to who has that permission.