Limiting the commands users can use in the background

By default, users can issue all TSO/E commands in background mode, except for the OPERATOR and TERMINAL commands and their aliases OPER and TERM. You may want to restrict the use of certain TSO/E commands to, for example, keep users from:

Using user-written commands that do not work in the background
Using commands whose use you plan on restricting in foreground mode.

To limit the use of commands in the background, you can either use SYS1.PARMLIB member IKJTSOxx, or update the CSECT IKJEFTNS. One advantage of using SYS1.PARMLIB member IKJTSOxx is that it is easier to update. You must reassemble and link-edit CSECT IKJEFTNS each time you update it.