RACF® program control checks authorization before allowing access to an ISMF function. Protection for each function is based on the authorization level of the load module that contains the function. A user is allowed to execute an ISMF function (for example, the RESTORE list command) when one of the following is true:

• The user is authorized to execute the load module corresponding to the function requested. Authorization is defined as READ level access or greater.
• The user’s RACF profile has the OPERATIONS attribute.
• The user’s group is authorized to execute the load module.
• The universal access authority (UACC) for the load module is READ or greater. This makes the load module available to anyone who can access ISMF.