I think they can do pretty much whatever they want...it's not like anyone is going to stop them...
Anybody smart will. Rather, any smart criminal will, although the smartest will avoid confronting them completely. They can't do whatever they want because they're private employees for a private business, and therefore can't enforce the law, or conduct any other policing activities legally. If they pull somebody into the AP office under suspicion of stealing, and said individual was innocent of stealing, the case could be made that they kidnapped the individual, and a good lawyer would have a field day with that case. This is why AP typically goes for repeat offenders that are presumably non-life threatening. As mentioned by Ross, their job isn't worth risking their lives over. If they suspect someone is habitually stealing, and also dangerous, they'll probably partner with the local police to have justice served without anybody getting injured other than the perpetrator. Anyway, the point is, when AP makes an apprehension, they're essentially making a citizen's arrest, and as such, they have to be dang sure that individual is guilty of a crime before making said citizens arrest. As I'm not a thief by principle, and not keen on having my time wasted by any store's asset protection, on principle I won't comply with any asset protection outside of my place of employment, and I am willing to sue over it too (again, I'm really not a thief, and actually have somewhat of a desire to be a police officer). At the same time though, people need to know their rights, and it goes without saying that they have ABSOLUTELY NO obligation to stop for a private security guard and follow said guard's directions. This is why, as I stated at the beginning, any smart criminal will stop AP in their tracks straight away. In most, if not all places in America, stealing is only a crime when intent is proven. If AP questions whether they paid for something, all they have to say is "OH DRAT! I TOTALLY FORGOT TO PUT X ITEM ON THE BELT, AND THE CASHIER DIDN'T REMIND ME! I'LL PAY NOW/ I DECIDED I DON'T WANT IT.", and it's done. No law was broken. That's it. That's why intent needs to be proven, and that's why AP goes after people that have been caught stealing multiple times (one of the reasons anyway, another big reason is that if they can get them on felony theft, it looks a lot better for them).
In essence, don't steal from spot. (THEY WILL KNOW, as their survallience is not only baller, but some of the best I've seen in any retailer ever. They can zoom in on you, in like 1080P, and watch your hands pilfer whatever it is you're pilfering. There are only a few legitimate ways to get away with stealing from spot, and really only for cheap items, mainly food, but I won't detail them here).
If you know someone is leaving without paying for something, stop them and let them know. Most of the time it's out of ignorance. People put merchandise on the bottom of their carts all the time, and then completely forget it's there when the time comes to check out. If they do get out, let AP know. It'll probably be nothing, but if they are indeed smart criminals, and they hit your store again, AP will be able to do the lord's work.
If you know, for a fact, beyond any reasonable doubt, that you see someone that's stolen more than once from your store, in your store, that's when you call AP RFN! I've personally never been in that situation, but if you recognize someone as a repeat offender, it's for a reason, and that reason is that they are indeed a crook, and that's when AP gets to do the lord's work.