AuthorizationActions.EditObject seems doesn't work on child object.

How to prevent user to edit child object?

I have class with f.ex "orders" property. This is "BusinessBindingListBase" which contains "Order" objects.

I thought I can add "authorization rule" (AuthorizationActions.EditObject) that implements some logic. But it never executes. I can edit this child object and even save it. It looks wierd. How to prevent child object editing?