security hole in interactive sql call statement?

["Lim Hock-Chai" <Lim.Hock-Chai@xxxxxxxx>]

We have a menu option that allow programmer to get into interactive sql 
(STRSQL) on our production box.  Our production files are secured to only allow 
view only access for programmers.  This work well with the exception of the 
call statement.  
 
Here is the problem: 
Programmer user profile is set to Limit Capabilities *YES.  However, in STRSQL, 
he/she can actually do this to exec a command: CALL 
qcmdexc('WRKACTJOB',000000009.00000) or call any program.  
 
Is this a security hole on AS400? 
 
Is there a way to lock down call statement in STRSQL?
 
thanks