I assumed that you are trying to control a UI "nest" with submits.
Converting to tcodes is one option.
Making correct application auth checks in the programs in addition to the tcode checks is even better and you can maintain SU24 proposals.
S_PROGNAM is seldom checked and as you habe seen, value * will wander into roles very quickly once folks start using it.
Lets see.. I will eat my hat if it realy works in praxis.
Cheers,
Julius