Authorization for running a batch DL/I program

When a DL/I batch application tries to run the first SQL statement, Db2 checks whether the authorization ID has the EXECUTE privilege for the plan. Db2 uses the same ID for subsequent authorization checks and also identifies records from the accounting and performance traces.

The primary authorization ID is the value of the USER parameter on the job statement, if that is available. If that parameter is not available, the primary authorization ID is the TSO logon name if the job is submitted. Otherwise, the primary authorization ID is the IMS PSB name. In that case, however, the ID must not begin with the string SYSADM because this string causes the job to abnormally terminate. The batch job is rejected if you try to change the authorization ID in an exit routine.