Why Shouldn't I Be Able To Open This Queue? MQ and CICS Security Topics

My auditors have asked how we are securing the CICS transactions that are started via MQ messages.  And right now I cannot tell them,,,'errrr, they are not, because we expected security to be done at the front end.'  We've found out that the front end security we were promised disappeared into the reality of "it is hard to do that."  And we, the responsible admins, are not quite sure what to do next.  What ID's can the transactions run under?  Are there differences whether the transaction is started with a triggered MQ message? What kind of authentication can MQ do these days?  How do I secure the queues?

Tracks: CICS Systems Programming, Middleware, Security and Compliance and Security in the Enterprise