The high-level qualifier of the name of a group data set is a RACF-defined group ID. As a RACF-defined user, you can RACF-protect a group data set under any of these conditions:

• You have JOIN, CONNECT or CREATE authority in the group.
• You have the group-SPECIAL attribute in the group that owns the user profile.
• You have the system-OPERATIONS attribute, and you are not connected to the group.

You can create new group data sets with the DFSMSdss COPY or RESTORE command in the following situations:

• You are acting as a DFSMSdss-authorized storage administrator through the ADMINISTRATOR keyword.
• You have DASDVOL-access authority to the non-SMS-managed volume that the data set is being created on.
• You have the OPERATIONS attribute, and you have not been explicitly denied access to the data set.
• The system has always-call, the data set name is protected by a generic profile, you have ALTER-access authority to the data set profile, and you do not have ADSP. Instead of ALTER access, you can have CREATE authority in the group and UPDATE access to the data set.
• The data set is not protected by a generic profile, and you do not have ADSP.