Hi Rich. I verified on my 2016.2.0 instance that Delegated Authentication works for SOAP requests. Initially I had problems similar to yours. Check the following:

1. ZAUTHENTICATE.mac is in the %SYS namespace.

2. It has a line similar to

  set Properties("Roles")="%Developer"

Otherwise you’ll get <PROTECT> errors.

Also, you may wish to check Devchange STC2188 – apparently Caché versions prior to 2014.1 had a problem with SOAP  delegated authentication.