Security considerations for the RACF parameter library

You should protect the RACF® parameter library by way of a DATASET profile. If you have not defined the RACF subsystem as trusted or privileged, make sure that it has READ access to the RACF parameter library.

Note:

No OPERCMDS authority check is performed for commands issued from the RACF parameter library, and these commands run with the authority of the RACF subsystem address space user ID.
An operator can issue a SET INCLUDE command to process a member that contains commands that the operator does not have authority to issue directly.