When a user logs on to TSO, TSO requests RACF® authorization checking for protected TSO resources such as account numbers and logon procedures. For example, suppose that during logon, user SMITH requests the use of account number 12345. If SMITH is authorized to use account number 12345, RACF grants the request. If SMITH is not authorized to use account number 12345, the following occur:

• A message is sent to the operator console indicating that user SMITH has been denied access to a RACF-protected resource.
• An SMF record is generated indicating that RACF failed an attempt to access a protected resource (unless your installation has specified an alternative auditing option for account numbers).
• User SMITH is prompted to enter a valid account number.