No 'call transaction' security from inbox?

[Michael Pokraka]

Hi all,
Scenario: transaction security based on S_TCODE, 4.6c system. This works well, except when a task does a CALL TRANSACTION as part of a dialog item.
If an item is executed from the inbox for a transaction which is NOT authorized, it happily ignores the auth check. I've put in a BREAK-POINT just to make sure: it stays in the same user context, the break point is reached, SY-UNAME is whgat is expected, and debugging reveals exactly nothing. (get to CALL TRANSACTION, hit F5, and it immediately jumps to the transaction's ABAP).
The same thing executed via SE38 does fail an authorization check.
 
Any thoughts?
Cheers
Mike