Hi Bernhard,
Looks like that is not the case.
We have granted access to only one T.code XD02 with s_saut_tcd authorization object.
But when we do negative testing for some other T.code FB02 System Rc = 4 in ST01 trace, but it still gives output with entries hit.
BR
Pankaj