Multi-trans programs should be trusted applications. They must do whatever cleanup is necessary between transactions to ensure that resources are released and transactions are isolated from one another and from any resources used exclusively by the shell.

Except for the cleanup responsibilities, multi-trans scheduling provides the same security protection as standard scheduling (checking user IDs, passwords, and profiles passed on each inbound conversation request). Each conversation with a multi-trans program runs under a personalized security environment, based on the user ID associated with the inbound request, when the multi-trans shell issues Get_Transaction and Return_Transaction to process conversations.

The generic user ID, specified in the TP profile, covers initialization and termination processing by the multi-trans shell, and any interim processing between a Return_Transaction and subsequent Get_Transaction call.

Because the generic ID covers processing that typically must be isolated from the different conversation partners, the generic ID must be secure from unauthorized specification or modification. To protect the generic ID, you can use RACF to control read and update access to the TP profile where the generic ID is specified.

To do so, your installation can define the APPCMVS.TP.MULTI resource to the RACF FACILITY class and put the authorized administrators on the resource access list, as described in z/OS MVS Planning: APPC/MVS Management. The administration of multi-trans TP profiles must be limited to administrators who have the same authority as the security administrator or to a system programmer who is responsible for updating authorized libraries.