A DD statement that contains a PROTECT parameter to establish RACF® protection for a tape data set must:

• Specify or imply VOLUME=PRIVATE.
• Specify or imply DISP=NEW, DISP=OLD, or DISP=SHR; it must not specify or imply DISP=MOD.
• Specify in the LABEL parameter a label type of:
  • SL or SUL for IBM® standard labels.
  • AL or AUL for ISO/ANSI Version 1 or ISO/ANSI/FIPS Version 3 tape labels.
  • NSL for nonstandard labels. In this case, the NSL installation exit routine must issue a RACDEF or RACROUTE TYPE=DEFINE macro instruction. See z/OS Security Server RACROUTE Macro Reference for a description of these macro instructions.
• If the data set is not the first on the volume, specify a data-set-sequence-number in the LABEL parameter, which requires that the RACF TAPEDSN option be active.