Connection, or Package Owner - what establishes security.

If you create a package, say a DTS Bulk Copy Package.
You set up the connection to the DB to use "SA".
The package is owned by "Someone"
The context the package runs under when scheduled is "SQLAgentCmdExec"

I'm not getting the chain of ownership - rights.

Forum Pros - if you can - tell me what each "piece" of this puzzle does.

1. Does the package run as "SA", "Someone's NT account", or SQLAgent NT acct?
2. Disk File Access (files as input for BCP) What determines rights to file?
3. Please tell me simple steps for guaranteed success of create DTS pkg and scheduling and runnning.