How SYSOUT requests are verified

The following is a simple network showing the path of a job:

Submitting node passes a job to the execution node which then passes SYSOUT to the printing node

For inbound SYSOUT, user verification occurs at the printing node instead of the submitting node (as it can for inbound jobs). On the printing node, RACF® authorization checking occurs in the NODES class, as it does for inbound jobs. RACF finds the best fit among the profiles in the NODES class and uses the information specified in the UACC and ADDMEM information.

Whether the SYSOUT is accepted is based on a combination of the owner's ID, group, or security label. Whether the security information is accepted and translated is based on the owner's ID taken from:

The job token from the NJE header as verified at the executing node
If no token is available (SYSOUT is from a downlevel node), the owner is considered to be the NJE undefined user as defined by:
```
SETROPTS(JES(NJEUSERID(userid)))
```

In addition, if &SUSER (submitting user) is specified on the ADDMEM operand, the submitter can be used as the owner if one of the following is also true:

The submitting node is defined as a local node in the &RACLNDE profile in the RACFVARS class. In this case, the submitting user and group are used as the SYSOUT owner values and are unchanged (no translation).
The NODES profile that matches is the profile named submit-node.USERS.submitter and UACC(CONTROL) is specified.
If there is a translate value, but it is not &SUSER, the SYSOUT owner user ID is the translate value. If it is &SUSER, the owner is the unchanged submitter user ID. In addition, a lookup is done for the NODES profile that matches the form submit-node.GROUPS.submit-group. If this profile has an ADDMEM translate value, that value is used as the SYSOUT owner group. Otherwise, the unchanged submit group is used. The UACC for this profile does not matter.