The RESCLASS option

Use the QUERY SECURITY command with the RESCLASS option when you want to query access levels for non-CICS® resources.

RESCLASS is the name of a valid RACF® general resource class, such as TERMINAL, FACILITY, or a similar installation-defined resource class. See RACF classes for protecting system resources. The class name identified by RESCLASS is treated literally, with no translation.

Note: The RACF classes DATASET, GROUP, and USER do not appear in the class descriptor table (CDT), which means that you cannot query against these classes.

Prefixing, as specified in the SECPRFX system initialization parameter, does not apply to QUERY SECURITY RESCLASS. That is, CICS does not prefix the RESID with the CICS-region userid, nor with a user-specified prefix, before calling RACF.

If SEC=NO is specified in the system initialization parameters, QUERY SECURITY RESCLASS always returns READABLE, UPDATABLE, CTRLABLE and ALTERABLE.

For QUERY SECURITY RESCLASS, both the RESID and the RESIDLENGTH option must be specified. The maximum length of a resource (RESID) within a RACF class is specified in the class descriptor table (CDT). When defining RESID values, you should be aware of the effects of including blanks (X'40') in RESIDs. For example, in: 
QUERY SECURITY RESCLASS('MYCLASS') RESID('MY PROFILE') RESIDLENGTH(10)
the presence of a blank causes an INVREQ condition. This is because RACF does not allow blanks to be embedded in a profile name.
Note: To determine access to CICS resources you should normally use RESTYPE, when the resource class is determined by the Xname system initialization parameter. However, if, for special reasons, you want to inquire about specific CICS resource classes, you should note that the class name must be the member class, and not the group class; that is, CCICSCMD, and not VCICSCMD. The profiles in the grouping class are checked automatically if the member class has been activated by RACLIST. For example, if SEC=YES, and XCMD=YES are specified, both CCICSCMD and VCICSCMD are activated by RACLIST in the CICS region, which means that QUERY SECURITY RESCLASS('CCICSCMD') checks profiles in both CCICSCMD and VCICSCMD.

CICS can RACLIST groups only if the relevant Xname classes are active (for example, XCMD=YES or XCMD=$USRCMD).

You can also use the RESCLASS option for querying access to DB2ENTRY resources defined in a user-defined resource class, which you specify to CICS on the XDB2 system initialization parameter. The rules about activating classes by means of the RACLIST command also apply to DB2ENTRY resource classes named on the XDB2 system initialization parameter. See Resource classes for DB2ENTRYs for more information about user-defined DB2ENTRY resource clases.

Issuing QUERY SECURITY RESCLASS('TERMINAL') checks profiles in both TERMINAL and GTERMINL (the terminal grouping class) only if the TERMINAL class has been activated by RACLIST at the system level by the command: 
SETROPTS RACLIST(TERMINAL)

For non-CICS resource classes, you can issue the SETROPTS RACLIST(classname) command to perform a global RACLIST. See Specifying user-defined resources to RACF for details.