RACF uses eight question marks (????????) as the userid for all inbound work meeting the above criteria. Your security administrator can assign a different userid using the RACF SETROPTS command. For example, if you want to process any of these jobs locally, you can define a single userid to which all of these undefined userids are translated. You can then permit that translated userid to specific resources. You can not directly permit the default userid (either IBM-supplied or installation-defined) to any resources. See z/OS Security Server RACF Security Administrator's Guide about defining default userids for NJE work that meet the criteria.