Question: Application of RBAC to actions in a workflow

Hi 

We should like to have an RBAC group which prevents random users from seeing all but a small set of "top level" workflows. In the case that we hide all the actions used by those workflows from those users, does the workflow implement some sort of RBAC bypass to allow _it_ to call those actions? If so, is there a setting to control it. 

Thanks!
