If RACF® is active, then MVS™ uses the z/OS® CMDAUTH function to verify that the operator console used to issue the DFSMShsm command is authorized to issue that DFSMShsm command.

If RACF is not active at DFSMShsm startup, then MVS does not perform any verification of commands that are issued from an operator console.

If you stop RACF while DFSMShsm is active, then MVS fails all DFSMShsm commands that are issued from an operator console.