Commands that specify the ONLYAT operand are subject to a security check to determine if the command issuer is authorized as follows:

• The command issuer and the target user ID must be SPECIAL.
• No user ID association is required if the target user ID is the same as the command issuer. The user IDs can be on different nodes.
• If the target user ID is different from the command issuer, a user ID association between the command issuer and the target user ID is required. This prevents a SPECIAL user from unauthorized use of another remote SPECIAL user ID.