Authorization problem with workitem execution

[Werner Kößl]

Good afternoon,
 
we have an authorization problem!
the problem is that the SAP-System does not check any authorization object
when a user executes a workitem!
So everyone is able to execute workitems and do all other functions
considering workitems.
 
Yes, i can adjust that with the agents in the workflow builder, so that only
the agents receive the workitem that are entered in the workflow steps.
But we mostly use an orgunit as an agent of a workitem. So the whole orgunit
receives the workitem.
But our orgunits have on the average 30 people and we cannot instruct
everyone!
 
It would be possible to use expressions instead of orgunits, but that's a
lot of work!
The easiest way would be to check the authorization object for the workitem
functions?!?
(And there is one object "S_WF_WI", but it is not used in the business
workplace!?)
 
Thanks in advance,
Werner.