If you have the SPECIAL attribute, you can prevent users who do not have the SPECIAL attribute from doing either of the following:

• Specifying or changing a security label in a resource profile
• Changing a SECLABEL profile using the RALTER command

To place this control into effect, enter:

SETROPTS SECLABELCONTROL

When the SECLABELCONTROL option is in effect, only certain users can specify the SECLABEL operand on RACF® commands:

• Users with the SPECIAL attribute can specify the SECLABEL operand on any RACF command.
• Users with the group-SPECIAL attribute can specify the SECLABEL operand only on the ADDUSER and ALTUSER commands when they add a user to a group within their scope of control. Also, group-SPECIAL users must be permitted to the SECLABEL profiles with at least READ access authority.
• Users without the SPECIAL attribute cannot specify the SECLABEL operand.