Controlling Catalog Functions with RACF Profiles in the FACILITY Class or XFACILIT Class

By defining and controlling access to profiles in the FACILITY class or XFACILIT class, you can control who can use certain catalog functions. Besides defining these profiles, you must activate the FACILITY class or XFACILIT class for these functions to be protected.

These profiles can be assigned to an owner. For example, the person responsible for managing catalogs can be assigned ownership of these profiles. A profile owner can then list, modify, or delete the profiles as needed.

The following RACF® commands show how to define a FACILITY profile, authorize a user to perform the functions restricted by the profile, and activate the FACILITY class. The profile defined is IGG.CATLOCK, which is assigned to user CATADMIN, and user USER01 is authorized to use the profile. 
    RDEFINE  FACILITY  IGG.CATLOCK  UACC(NONE) OWNER(CATADMIN)

    PERMIT  IGG.CATLOCK  CLASS(FACILITY)  ID(USER01) ACCESS(READ)

    SETROPTS CLASSACT(FACILITY)
The RDEFINE command creates the profile and gives it a universal access authority (UACC) of NONE. Because READ authority to the profile allows a user to perform the protected function, you must use a UACC of NONE to limit the use of the protected function. The PERMIT command is used to authorize the appropriate users or groups to perform the protected function. If the FACILITY class is already active, refresh SETROPTS.
Start of changeException: For 3.1 users, the FACILITY class profile for STGADMIN.IGG.AUTO.BYPASS.LOG should be defined similar to the following, so that all 3.1 users' bypasses of SAF checks during VSAM OPENs can be logged.
RDEFINE FACILITY STGADMIN.IGG.AUTO.BYPASS.LOG UACC(READ)
AUDIT(SUCCESS) OWNER(CATADMIN)
Or use UACC(NONE) on the above command then issue
PERMIT STGADMIN.IGG.AUTO.BYPASS.LOG
      CLASS(FACILITY) ID(*) ACCESS(READ)
End of change