In the Events area, there is a special add button that contains a pull-down where an Auction Event can be added. For users who do not have rights to the Event Auction Add Data Form or the Action Group for Auction Events, the add action can still performed. It doesn't seem that there is a way to disable it.
We're currently evaluating this issue for a fix in a future release.
Steps to Duplicate
1. Go to Events 2. Select Page Designer 3. Edit Action Groups > Delete the Group for Auction events 4. Go to Administration > Security > System Roles. Open a role that does not have rights to the Event Auction Add Data Form or the Action Group for Auction Events. 5. Add this System role to a non-admin user and log into the application as that user. 7. Select Events 8. Click Add > Add an Auction event 9. The Add form appears