Unable to avoid tcode check after update SE97

Hello,

For a change project, our customers requested the possibility to be able to cancel invoices through VF02, while avoiding direct access to VF11.

In order to achieve this, I have tried to put the check indicator in SE97 to NO for tcode VF11 and removed the VF11 transaction from the respective end-user role.

To my understanding, this should prevent the tcode check when CALL_TRANSACTION is performed. Trying to chose the option cancel invoice now however results in the standard message that there is no authorization for VF11.

Any suggestions as to what I am overlooking? (or am I perhaps misunderstanding the SE97 functionality).

Thanks in advance.