Citrix Shadowing Permissions

Our new “policy” people say that we need to get user’s permissions before shadowing – I have gone through Active Directory and switched on the Require Users Permissions option on the Remote Control Tab of the user’s properties, but Citrix seems to ignore it and shadow without anyway – what am I missing ? Have also tried to configure a “shadowing” policy that should prohibit shadowing without permissions, this doesn’t work either.