Batch Workload Visibility and Elevated Authority Analysis

Steps

1. Executive Summary

Batch jobs on IBM i represent one of the most overlooked security surfaces in enterprise environments. Unlike interactive jobs — where a user signs on, performs work, and signs off — batch jobs run unattended, often under service account profiles with elevated authority, and may execute programs that adopt additional authority at runtime. This creates a compounding risk:

• A batch job submitted by a low-privilege user can run under a high-privilege service account
• A program within that job can adopt the authority of its owner — a profile with *ALLOBJ — for the duration of a call
• All of this happens without a sign-on event, without an operator present, and without explicit audit configuration targeting the batch infrastructure

This document provides SQL-based tooling to enumerate active and queued batch workloads, cross-reference job attributes with user privilege data, identify jobs with elevated effective access, and surface authority adoption chains.

2. Background — Work Management and Security Posture

2.1 Why Batch Jobs Are a Security Blind Spot

The combination of long-running execution, deferred start, and potential authority adoption makes batch infrastructure the most common path for privilege escalation without a detectable authentication event.

2.2 Key Identity Fields: JOB_USER vs. AUTHORIZATION_NAME vs. Effective Profile

2.3 Authority Adoption — How Programs Elevate Access

3. SQL Queries — Batch Workload Visibility

3.1 Active Batch Jobs by Subsystem

-- Active batch jobs grouped by subsystem
-- Use to understand which subsystems carry the majority of batch workload
-- and which subsystems are running jobs under privileged profiles
SELECT
    J.SUBSYSTEM,
    J.SUBSYSTEM_LIBRARY_NAME,
    COUNT(*)                                         AS JOB_COUNT,
    COUNT(DISTINCT J.JOB_USER)                       AS UNIQUE_USERS,
    COUNT(DISTINCT J.AUTHORIZATION_NAME)             AS UNIQUE_CURRENT_USERS,
    SUM(CASE WHEN J.JOB_USER <> J.AUTHORIZATION_NAME
             THEN 1 ELSE 0 END)                      AS IDENTITY_MISMATCHES,
    SUM(CASE WHEN J.JOB_STATUS = 'RUN'  THEN 1 ELSE 0 END) AS RUNNING,
    SUM(CASE WHEN J.JOB_STATUS = 'MSGW' THEN 1 ELSE 0 END) AS WAITING_ON_MSG
FROM TABLE(QSYS2.ACTIVE_JOB_INFO()) AS J
WHERE J.JOB_TYPE = 'BCH'
  AND J.JOB_USER          NOT IN ('QSYS', 'QTCP')   -- Exclude system-submitted jobs
  AND J.AUTHORIZATION_NAME NOT IN ('QSYS', 'QTCP')  -- Exclude system running-as profiles
GROUP BY J.SUBSYSTEM, J.SUBSYSTEM_LIBRARY_NAME
ORDER BY JOB_COUNT DESC;

Sample Report

3.2 Active Batch Jobs by Job Queue

-- Active and queued batch jobs grouped by job queue
-- Use to identify over-loaded queues and queues attached to high-privilege subsystems
SELECT
    JOB_QUEUE,
    JOB_QUEUE_LIBRARY,
    COUNT(*)                                         AS JOB_COUNT,
    SUM(CASE WHEN JOB_STATUS = 'ACTIVE' THEN 1 ELSE 0 END) AS ACTIVE,
    SUM(CASE WHEN JOB_STATUS = 'JOBQ'   THEN 1 ELSE 0 END) AS QUEUED,
    SUM(CASE WHEN JOB_STATUS = 'OUTQ'   THEN 1 ELSE 0 END) AS OUTPUT_WAIT,
    COUNT(DISTINCT JOB_USER)                         AS UNIQUE_SUBMITTED_USERS,
    MIN(JOB_ENTERED_SYSTEM_TIME)                     AS OLDEST_JOB_ENTERED,
    MAX(JOB_ENTERED_SYSTEM_TIME)                     AS NEWEST_JOB_ENTERED
FROM TABLE(QSYS2.ACTIVE_JOB_INFO()) AS J
WHERE JOB_TYPE = 'BCH'
GROUP BY JOB_QUEUE, JOB_QUEUE_LIBRARY
ORDER BY JOB_COUNT DESC;

3.3 Active Batch Jobs by Submitted User

-- All active batch jobs grouped by the user who submitted them (JOB_USER)
-- Identifies which users have the most batch workload in flight
SELECT
    J.JOB_USER,
    COUNT(*)                                         AS JOB_COUNT,
    COUNT(DISTINCT J.SUBSYSTEM)                      AS SUBSYSTEMS_USED,
    COUNT(DISTINCT J.JOB_QUEUE)                      AS JOB_QUEUES_USED,
    SUM(CASE WHEN J.JOB_USER <> J.AUTHORIZATION_NAME
             THEN 1 ELSE 0 END)                      AS JOBS_WITH_IDENTITY_SWITCH,
    MIN(J.JOB_ENTERED_SYSTEM_TIME)                   AS EARLIEST_SUBMISSION,
    MAX(J.JOB_ENTERED_SYSTEM_TIME)                   AS LATEST_SUBMISSION
FROM TABLE(QSYS2.ACTIVE_JOB_INFO()) AS J
WHERE J.JOB_TYPE = 'BCH'
  AND J.JOB_USER          NOT IN ('QSYS', 'QTCP')
  AND J.AUTHORIZATION_NAME NOT IN ('QSYS', 'QTCP')
GROUP BY J.JOB_USER
ORDER BY JOB_COUNT DESC;

3.4 Active Batch Jobs by Current (Running) User

-- Grouped by AUTHORIZATION_NAME — the effective security context, not the submitting identity
-- A high-privilege profile appearing here with many jobs warrants scrutiny
SELECT
    J.AUTHORIZATION_NAME                             AS RUNNING_AS,
    COUNT(*)                                         AS JOB_COUNT,
    COUNT(DISTINCT J.JOB_USER)                       AS UNIQUE_SUBMITTERS,
    COUNT(DISTINCT J.SUBSYSTEM)                      AS SUBSYSTEMS,
    SUM(CASE WHEN J.JOB_USER <> J.AUTHORIZATION_NAME
             THEN 1 ELSE 0 END)                      AS RUNNING_AS_DIFFERENT_USER,
    MIN(J.JOB_ENTERED_SYSTEM_TIME)                   AS OLDEST_IN_QUEUE
FROM TABLE(QSYS2.ACTIVE_JOB_INFO()) AS J
WHERE J.JOB_TYPE = 'BCH'
  AND J.JOB_USER          NOT IN ('QSYS', 'QTCP')
  AND J.AUTHORIZATION_NAME NOT IN ('QSYS', 'QTCP')
GROUP BY J.AUTHORIZATION_NAME
ORDER BY JOB_COUNT DESC;

3.5 Job Queue Depth and Backlog

-- Job queue depth by job queue — uses SYSTOOLS.JOB_QUEUE_ENTRIES
-- Queued jobs are not yet running but will acquire the running user's authority when they start
SELECT
    A.JOB_QUEUE_NAME,
    A.JOB_QUEUE_LIBRARY,
    COUNT(*)                                         AS TOTAL_QUEUED,
    MIN(A.JOB_QUEUE_TIME)                            AS OLDEST_QUEUED,
    TIMESTAMPDIFF(4,
        CHAR(CURRENT_TIMESTAMP - CAST(MIN(A.JOB_QUEUE_TIME) AS TIMESTAMP)))
                                                     AS OLDEST_WAIT_MINUTES,
    COUNT(DISTINCT A.JOB_USER)                       AS UNIQUE_USERS
FROM SYSTOOLS.JOB_QUEUE_ENTRIES AS A
WHERE A.JOB_TYPE = 'BCH'
GROUP BY A.JOB_QUEUE_NAME, A.JOB_QUEUE_LIBRARY
ORDER BY TOTAL_QUEUED DESC;

4. SQL Queries — Cross-Referencing Jobs with Privilege Data

4.1 Active Jobs Running Under Profiles with Special Authority

-- Primary high-risk intersection: elevated profile actively running batch work
SELECT
    J.JOB_NAME,
    J.JOB_USER                                       AS SUBMITTED_BY,
    J.AUTHORIZATION_NAME                             AS RUNNING_AS,
    J.SUBSYSTEM,
    J.JOB_QUEUE,
    J.JOB_STATUS,
    J.JOB_ENTERED_SYSTEM_TIME,
    U.USER_CLASS_NAME,
    U.SPECIAL_AUTHORITIES,
    U.STATUS                                         AS PROFILE_STATUS,
    CASE
        WHEN U.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'  THEN 'CRITICAL'
        WHEN U.SPECIAL_AUTHORITIES LIKE '%*SECADM%'  THEN 'HIGH'
        WHEN U.SPECIAL_AUTHORITIES LIKE '%*JOBCTL%'
          OR U.SPECIAL_AUTHORITIES LIKE '%*IOSYSCFG%'
          OR U.SPECIAL_AUTHORITIES LIKE '%*AUDIT%'   THEN 'MEDIUM'
        ELSE 'LOW'
    END                                              AS RISK_LEVEL
FROM TABLE(QSYS2.ACTIVE_JOB_INFO()) AS J
JOIN QSYS2.USER_INFO AS U
    ON U.AUTHORIZATION_NAME = J.AUTHORIZATION_NAME
WHERE J.JOB_TYPE            = 'BCH'
  AND U.SPECIAL_AUTHORITIES <> '*NONE'
  AND J.JOB_USER          NOT IN ('QSYS', 'QTCP')
  AND J.AUTHORIZATION_NAME NOT IN ('QSYS', 'QTCP')
ORDER BY RISK_LEVEL, J.AUTHORIZATION_NAME, J.JOB_NAME;

Sample Report

4.2 Jobs Where Running User Differs from Submitted User

-- Indicates SBMJOB USER(other), profile switching, or prestart job reuse
-- Join with USER_INFO to show the privilege level of both identities
SELECT
    J.JOB_NAME,
    J.JOB_USER                                       AS SUBMITTED_BY,
    US.SPECIAL_AUTHORITIES                           AS SUBMITTER_AUTHORITIES,
    J.AUTHORIZATION_NAME                             AS RUNNING_AS,
    UR.SPECIAL_AUTHORITIES                           AS RUNNING_AUTHORITIES,
    J.SUBSYSTEM,
    J.JOB_QUEUE,
    J.JOB_STATUS,
    J.JOB_ENTERED_SYSTEM_TIME,
    CASE
        WHEN UR.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%' THEN 'CRITICAL'
        WHEN UR.SPECIAL_AUTHORITIES LIKE '%*SECADM%' THEN 'HIGH'
        WHEN UR.SPECIAL_AUTHORITIES <> '*NONE'       THEN 'MEDIUM'
        ELSE 'INFO'
    END                                              AS RISK_ASSESSMENT
FROM TABLE(QSYS2.ACTIVE_JOB_INFO()) AS J
JOIN QSYS2.USER_INFO AS US
    ON US.AUTHORIZATION_NAME = J.JOB_USER
JOIN QSYS2.USER_INFO AS UR
    ON UR.AUTHORIZATION_NAME = J.AUTHORIZATION_NAME
WHERE J.JOB_TYPE    = 'BCH'
  AND J.JOB_USER   <> J.AUTHORIZATION_NAME
  AND J.JOB_USER          NOT IN ('QSYS', 'QTCP')
  AND J.AUTHORIZATION_NAME NOT IN ('QSYS', 'QTCP')
ORDER BY RISK_ASSESSMENT, J.JOB_NAME;

4.3 Batch Jobs Running Under Disabled Profiles

-- A disabled profile should not be the running identity for any active work
-- This indicates a profile was disabled while jobs were in flight
SELECT
    J.JOB_NAME,
    J.JOB_USER                                       AS SUBMITTED_BY,
    J.AUTHORIZATION_NAME                             AS RUNNING_AS,
    U.STATUS                                         AS PROFILE_STATUS,
    U.SPECIAL_AUTHORITIES,
    J.SUBSYSTEM,
    J.JOB_STATUS,
    J.JOB_ENTERED_SYSTEM_TIME
FROM TABLE(QSYS2.ACTIVE_JOB_INFO()) AS J
JOIN QSYS2.USER_INFO AS U
    ON U.AUTHORIZATION_NAME = J.AUTHORIZATION_NAME
WHERE J.JOB_TYPE = 'BCH'
  AND U.STATUS   = '*DISABLED'
  AND J.JOB_USER          NOT IN ('QSYS', 'QTCP')
  AND J.AUTHORIZATION_NAME NOT IN ('QSYS', 'QTCP')
ORDER BY J.JOB_ENTERED_SYSTEM_TIME;

5. SQL Queries — Adopted Authority and Elevated Effective Access

5.1 Programs with Adopted Authority (*OWNER)

-- All *PGM objects configured to adopt owner authority (USER_PROFILE = *OWNER)
-- Cross-referenced with the owner's special authority level
-- QSYS-owned IBM-supplied programs are excluded
SELECT
    P.PROGRAM_LIBRARY                                AS LIBRARY,
    P.PROGRAM_NAME,
    P.OBJECT_TYPE,
    P.PROGRAM_OWNER                                  AS OWNER,
    P.CREATE_TIMESTAMP                               AS CREATED,
    U.STATUS                                         AS OWNER_STATUS,
    U.SPECIAL_AUTHORITIES                            AS OWNER_AUTHORITIES,
    U.USER_CLASS_NAME                                AS OWNER_CLASS,
    CASE
        WHEN U.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'  THEN 'CRITICAL'
        WHEN U.SPECIAL_AUTHORITIES LIKE '%*SECADM%'  THEN 'HIGH'
        WHEN U.SPECIAL_AUTHORITIES <> '*NONE'        THEN 'MEDIUM'
        WHEN U.STATUS = '*DISABLED'                  THEN 'REVIEW'
        ELSE 'LOW'
    END                                              AS RISK_LEVEL
FROM QSYS2.PROGRAM_INFO AS P
JOIN QSYS2.USER_INFO AS U
    ON U.AUTHORIZATION_NAME = P.PROGRAM_OWNER
WHERE P.USER_PROFILE  = '*OWNER'
  AND P.OBJECT_TYPE   = '*PGM'
  AND P.PROGRAM_OWNER <> 'QSYS'
ORDER BY RISK_LEVEL, P.PROGRAM_LIBRARY, P.PROGRAM_NAME;

Sample Report

5.2 Jobs with Access to Adopted-Authority Programs

-- Active batch jobs whose running user has access to programs that adopt *ALLOBJ
-- Shows eligibility — not confirmation the program is currently on the call stack
SELECT
    J.JOB_NAME,
    J.JOB_USER                                       AS SUBMITTED_BY,
    J.AUTHORIZATION_NAME                             AS RUNNING_AS,
    J.SUBSYSTEM,
    J.JOB_STATUS,
    P.PROGRAM_LIBRARY                                AS ADOPTED_AUTH_PGM_LIBRARY,
    P.PROGRAM_NAME                                   AS ADOPTED_AUTH_PROGRAM,
    P.PROGRAM_OWNER,
    U.SPECIAL_AUTHORITIES                            AS OWNER_AUTHORITIES
FROM TABLE(QSYS2.ACTIVE_JOB_INFO()) AS J
JOIN QSYS2.PROGRAM_INFO AS P
    ON P.USER_PROFILE = '*OWNER'
   AND P.OBJECT_TYPE  = '*PGM'
JOIN QSYS2.USER_INFO AS U
    ON U.AUTHORIZATION_NAME = P.PROGRAM_OWNER
   AND U.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'
WHERE J.JOB_TYPE = 'BCH'
  AND J.JOB_USER          NOT IN ('QSYS', 'QTCP')
  AND J.AUTHORIZATION_NAME NOT IN ('QSYS', 'QTCP')
  AND P.PROGRAM_OWNER     <> 'QSYS'
ORDER BY J.AUTHORIZATION_NAME, P.PROGRAM_LIBRARY, P.PROGRAM_NAME;

5.3 Programs Adopting Authority Owned by Privileged Profiles

-- Grouped by owner to show concentration of adopted-authority exposure
SELECT
    P.PROGRAM_OWNER,
    U.USER_CLASS_NAME,
    U.SPECIAL_AUTHORITIES,
    U.STATUS                                         AS OWNER_STATUS,
    COUNT(*)                                         AS ADOPTING_OBJECT_COUNT,
    SUM(CASE WHEN P.OBJECT_TYPE = '*PGM'    THEN 1 ELSE 0 END) AS PROGRAMS,
    SUM(CASE WHEN P.OBJECT_TYPE = '*SRVPGM' THEN 1 ELSE 0 END) AS SERVICE_PROGRAMS,
    LISTAGG(DISTINCT P.PROGRAM_LIBRARY, ', ')
        WITHIN GROUP (ORDER BY P.PROGRAM_LIBRARY)    AS LIBRARIES
FROM QSYS2.PROGRAM_INFO AS P
JOIN QSYS2.USER_INFO AS U
    ON U.AUTHORIZATION_NAME = P.PROGRAM_OWNER
WHERE P.USER_PROFILE = '*OWNER'
  AND P.OBJECT_TYPE  IN ('*PGM', '*SRVPGM')
  AND (U.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'
    OR U.SPECIAL_AUTHORITIES LIKE '%*SECADM%')
GROUP BY P.PROGRAM_OWNER, U.USER_CLASS_NAME, U.SPECIAL_AUTHORITIES, U.STATUS
ORDER BY ADOPTING_OBJECT_COUNT DESC;

5.4 Service Programs in Authority Adoption Chains

-- *SRVPGM objects with USER_PROFILE(*OWNER)
-- Called via procedure interfaces — hardest to trace in call stacks; highest audit gap
SELECT
    P.PROGRAM_LIBRARY                                AS LIBRARY,
    P.PROGRAM_NAME                                   AS SERVICE_PROGRAM,
    P.PROGRAM_OWNER                                  AS OWNER,
    P.CREATE_TIMESTAMP                               AS CREATED,
    U.SPECIAL_AUTHORITIES                            AS OWNER_AUTHORITIES,
    U.STATUS                                         AS OWNER_STATUS,
    CASE
        WHEN U.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'  THEN 'CRITICAL'
        WHEN U.SPECIAL_AUTHORITIES LIKE '%*SECADM%'  THEN 'HIGH'
        WHEN U.SPECIAL_AUTHORITIES <> '*NONE'        THEN 'MEDIUM'
        ELSE 'LOW'
    END                                              AS RISK_LEVEL
FROM QSYS2.PROGRAM_INFO AS P
JOIN QSYS2.USER_INFO AS U
    ON U.AUTHORIZATION_NAME = P.PROGRAM_OWNER
WHERE P.USER_PROFILE = '*OWNER'
  AND P.OBJECT_TYPE  = '*SRVPGM'
ORDER BY RISK_LEVEL, P.PROGRAM_LIBRARY, P.PROGRAM_NAME;

6. SQL Queries — Comprehensive Risk Dashboard

6.1 Full Batch Security Risk Summary

-- Combines job identity, privilege level, and identity-switch detection in a single view
-- Designed for daily or weekly security reporting on batch workload posture
SELECT
    J.JOB_NAME,
    J.JOB_USER                                       AS SUBMITTED_BY,
    J.AUTHORIZATION_NAME                             AS RUNNING_AS,
    J.SUBSYSTEM,
    J.JOB_QUEUE,
    J.JOB_STATUS,
    J.JOB_ENTERED_SYSTEM_TIME,
    U.USER_CLASS_NAME,
    U.SPECIAL_AUTHORITIES,
    U.STATUS                                         AS PROFILE_STATUS,
    CASE WHEN J.JOB_USER <> J.AUTHORIZATION_NAME
         THEN 'YES' ELSE 'NO' END                    AS IDENTITY_SWITCHED,
    CASE WHEN U.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'  THEN 'CRITICAL'
         WHEN U.SPECIAL_AUTHORITIES LIKE '%*SECADM%'  THEN 'HIGH'
         WHEN U.SPECIAL_AUTHORITIES LIKE '%*AUDIT%'
           OR U.SPECIAL_AUTHORITIES LIKE '%*IOSYSCFG%'
           OR U.SPECIAL_AUTHORITIES LIKE '%*JOBCTL%'  THEN 'MEDIUM'
         WHEN J.JOB_USER <> J.AUTHORIZATION_NAME     THEN 'REVIEW'
         WHEN U.STATUS = '*DISABLED'                  THEN 'REVIEW'
         ELSE 'LOW'
    END                                              AS RISK_LEVEL
FROM TABLE(QSYS2.ACTIVE_JOB_INFO()) AS J
JOIN QSYS2.USER_INFO AS U
    ON U.AUTHORIZATION_NAME = J.AUTHORIZATION_NAME
WHERE J.JOB_TYPE = 'BCH'
  AND J.JOB_USER          NOT IN ('QSYS', 'QTCP')
  AND J.AUTHORIZATION_NAME NOT IN ('QSYS', 'QTCP')
ORDER BY RISK_LEVEL, J.AUTHORIZATION_NAME, J.JOB_NAME;

Sample Report

6.2 Authority Adoption Exposure by Library

-- Summarizes adopted-authority program exposure by library
-- Useful for scoping which application libraries carry the most adoption risk
SELECT
    P.PROGRAM_LIBRARY                                AS LIBRARY,
    COUNT(*)                                         AS ADOPTING_OBJECTS,
    SUM(CASE WHEN P.OBJECT_TYPE = '*PGM'    THEN 1 ELSE 0 END) AS PROGRAMS,
    SUM(CASE WHEN P.OBJECT_TYPE = '*SRVPGM' THEN 1 ELSE 0 END) AS SERVICE_PROGRAMS,
    SUM(CASE WHEN U.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'
             THEN 1 ELSE 0 END)                      AS ALLOBJ_OWNER_COUNT,
    SUM(CASE WHEN U.SPECIAL_AUTHORITIES LIKE '%*SECADM%'
             THEN 1 ELSE 0 END)                      AS SECADM_OWNER_COUNT,
    LISTAGG(DISTINCT P.PROGRAM_OWNER, ', ')
        WITHIN GROUP (ORDER BY P.PROGRAM_OWNER)      AS OWNERS
FROM QSYS2.PROGRAM_INFO AS P
JOIN QSYS2.USER_INFO AS U
    ON U.AUTHORIZATION_NAME = P.PROGRAM_OWNER
WHERE P.USER_PROFILE  = '*OWNER'
  AND P.OBJECT_TYPE   IN ('*PGM', '*SRVPGM')
  AND P.PROGRAM_OWNER <> 'QSYS'
GROUP BY P.PROGRAM_LIBRARY
ORDER BY ALLOBJ_OWNER_COUNT DESC, ADOPTING_OBJECTS DESC;

7. Remediation and Operational Guidance

Phase 1 — Baseline the Batch Environment

Phase 2 — Investigate Identity Switches

Phase 3 — Reduce Authority Adoption Surface

Phase 4 — Harden Service Account Profiles

Phase 5 — Ongoing Monitoring

8. Quick Reference