The secondary authorization function can provide authorization for sessions that were deferred by the initial authorization function, or all successful session authorization requests if the exit routine does not process the initial authorization function. Secondary authorization is processed during session initiation. If the begin function specifies that the exit is to be called for LU session takeover, and the session being taken over is established using extended BIND protocols, the secondary authorization function is called. If authorization was deferred by initial authorization and the session fails before secondary authorization, the secondary authorization will be called to inform the exit of the failure. An indicator in the related session information indicates whether the invocation is because of session setup or failure.

The secondary authorization function sometimes receives more information about a session from VTAM® than does the initial authorization function. The DLU's real name, network identifier, and owning SSCP might not be known at initial authorization, but are known at secondary authorization.

For normal initiation processing, the initial authorization function does not know the DLU gateway information vector (GIV) at initial authorization time. It can, however, be determined by looking at the parameter list obtained when the secondary authorization function is invoked.

For same-domain sessions, the function is processed before the INIT response.

If the exit routine processes neither initial nor secondary authorization functions (because they were not selected during begin function processing), all sessions are authorized.