Defined Security Rule not Preventing Accounts Payable from using Excluded Company

Hello, we are trying to prevent our accounts payable group from entering invoices to a specific company, 'XX'.  Our general ledger group still enters journal entries to this company. 

I've defined a security rule to include companies 'AA' to 'ZZ' and exclude company 'XX' to 'XX'.  I've also assigned this rule to the AP responsiblity for keying invoices and saved it.

When I enter a test batch into invoice batches, under the AP responsiblity, I am still able to enter invoices to company 'XX' and also validate the batch.  I thought defining the security rule would prevent AP from doing this, so I am not sure if I am missing something?