I would assume defensive rolls play like this: The owner/user defends against every action, even their own, by default. They may opt to forgo this defense if they feel the action is legitimate or benefits them.
This does assume that you -can- choose not to defend against something. I feel this is a reasonable assumption, and creates the best play environment.
As for Puppeteer, you guys are getting really pedantic. If you're going down this road, devices don't take independent matrix actions at all. People in the meatworld use devices to take actions. Since Puppeteer can't target those people (it targets Devices), Puppeteer does nothing at all and the writers really just felt like wasting their wordcount and confusing us. Woo~.
Sarcasm aside, there is a certain amount of common sense that has to be applied to make an ability work. That said, when it comes to Invite Mark, I'm not sure its intended for Puppeteer to be a good method of using it. Even if it works (I'm debating, the "Owner" is always the one defending against the action, after all) you have the sticky issue of this line:
"You may revoke your offer at any time before the mark is placed, but once another icon has a mark, you need to either use the Erase Mark action or reboot your device to remove it before the duration you chose expires."
So it goes something like this: "I puppeteer you to invite mark." "Whatever, I immediately revoke your permission as a non-action." "I... well, shit." Resonance seems to be more about bypassing the mark system entirely for short duration than feeding into it.
And yes, a Security Spider worth his salt is going to have an Agent monitoring every mark on every device under his care. If something shows up he, the person, does not recognize then it would have action taken against it. This has to happen, or otherwise sleaze specialists would just troll everything.
All of -that- said. The Owner thing is a tad odd in respect to companies, especially in regards to Full Matrix Defense.