Issues with Adopted Authority

Users in our ERP system are currently members of a group profile which has
too many privileges. This dates to the days when menu security and limit
capabilities *yes was enough to keep users in their box. I'm attempting
to change the security model for this system. I can successfully
implement adopted authority for these users for the interactive portions
of this system. However the wheels fall off when these interactive jobs
do a "sbmjob" and submit a program to run in batch. The call stack is
lost and therefore they have no authority to the objects needed to run the
program.

I thought I could address this be writing my own sbmjob (SUBMIT) command
and substituting it in the code everywhere sbmjob was found. This command
takes the command string used on the sbmjob and submits a job calling a
program I wrote. I give my users rights to my program and set it to adopt
authority of the needed group. My thought was by having my program in the
call stack, adopted authority could be put in place.

My program takes the command string and uses QCMDEXC to run it. This
doesn't work. QCMDEXC breaks the authority adoption because it is set to
User Profile *USER. I clearly don't want to change QCMDEXC.

Any thoughts on how I can get my program to run a command string, passed
as a parameter, in such a way as to preserve the adopted authority string?

Any help is greatly appreciated.

Joe