In design mode security is not applied
When the Framework is run in design mode, Framework authority to applications / business objects / commands is not applied, because the designer needs to be able to see all Framework objects.
To test how Framework security will be applied to end-users, start the Framework using UF_EXEC, or access the Framework using a web browser.