When defining users to RACF® with the ADDUSER command, or when modifying user attributes with the ALTUSER command, RACF security and group administrators should assign:

• SPECIAL, AUDITOR, and OPERATIONS attributes to only those users responsible for administering RACF on a system-wide basis
• CLAUTH attributes to only those users who are responsible for defining other users and general resources
• RESTRICTED attribute to only those user IDs that should not gain access to protected resources they are not specifically authorized to access