If protect-all has been activated, you can access a data set only through a data set profile or through an entry in the global access checking table. When always-call is in effect, RACF® is called whenever a data set is accessed or DASD space is allocated. When RACF is called because of always-call (and not because of RACF-indication), it only checks generic profiles and the global access checking table. If protect-all is not in effect and RACF cannot find an appropriate data set profile or entry in the global access checking table, RACF accepts the request by default. Be aware of the following conditions:

• Always-call is in effect if the data sets are cataloged.
• Data sets that are not RACF-indicated, but which are protected by generic profiles and always-call, are not protected if they are transferred to another system that does not have RACF, always-call, and appropriate generic profiles.
• VSAM data sets are protected only by the RACF profile for the cluster name. Profiles for the index- and data-component names are ignored, as are the profiles associated with any PATHs or with the cluster’s alternate indexes (AIXs).