Each program has associated with it a PSW-key mask (PKM) value. The PKM is a string of 16 bits that represents storage protection keys that are valid for a problem state program to use, where bit n equal to 1 indicates that the program is authorized to use key n. The system uses the PKM to check the authorization of problem state programs only. Supervisor state programs do not require PKM authority.

All programs are initially dispatched with a PKM value equal to the storage protect key of the program's TCB or SRB. Example: A PKM value of X'0080' represents key 8 and X'0001' represents key 15. The PC, PR, and PT instructions can change the PKM value.

The entry that defines the PC routine in the entry table contains two fields that are related to the PKM. Those fields are the authorization key mask (AKM) and the entry key mask (EKM). The AKM is a 16-bit string value that indicates the keys that will authorize a problem state program to invoke the PC routine. A problem state program can invoke the PC routine if at least one bit in the PKM and the corresponding bit in the AKM are both on (set to B‘1’).

The EKM is a 16-bit string value like the PKM. It can be used to alter the PSW keys under which the PC routine will run. For a basic PC routine, the system ORs the EKM into the PKM before the PC routine receives control. The result of the OR operation is the PKM under which the PC routine will run. A stacking PC routine can either have the system OR the EKM into the PKM, or have the system replace the PKM with the EKM.