Access to a form is only checked when the form is shown. So, during the Show() command of the form, the security is checked, and the form is either allowed to show, or a message is shown to the user informing them that the form cannot be shown.So, there is one of two things happening: 1) the form is being shown in some other way that is not checking security, or 2) the GetPermission() method of the CurrentUser object is returning the wrong value.
Let's start by checking the second option. Put a break point somewhere after the user has logged into the system, and check the value of MicroFour.StrataFrame.Security.CurrentUser.GetPermission("Salesperson") and see what the return value is of that method. It will return a PermissionInfo object that will contain the action to take.