Use of Security Restrict When Calling Server Action as an API

I am calling a server action call_me.php via a post call from a server action call_api.php.

All works okay, but if I include a Server Restrict action in call_me.php then I get an authorisation error.

Is this to be expected, or is it a bug?

Best wishes,
Antony.