What it means
ICH408I is the standard RACF message for a failed authorisation check. It shows the user (or the job and step), the resource and its class, the access the program wanted, and the access RACF would allow. The reason sits on one of the lines, for example INSUFFICIENT ACCESS AUTHORITY.
The same message number is used for several kinds of check, so the reason text matters most. Read it first, then compare the access wanted with the access allowed.
Typical causes
- The user ID has no access, or less access than asked for, in the profile's access list.
- The user is not connected to a group that is on the access list.
- A job or started task has no valid user environment, so the message shows JOB and STEP instead of USER and GROUP.
- The work ran under a different user ID from the one you expected.
How to fix it
- Read the full message: user, resource, access intended and access allowed.
- Check which user ID the job, session or started task really ran under.
- Ask whether the access level asked for is really needed, for example UPDATE when READ would do.
- Raise a request through your normal access process so the security administrator can review and grant the right access.
- Quote the complete message text in the request so the administrator can find the profile quickly.
Example
Illustrative only; names and values are invented.
ICH408I USER(USER01 ) GROUP(DEVGRP ) NAME(TEST USER )
PAY.MASTER.FILE CL(DATASET ) VOL(VOL001)
INSUFFICIENT ACCESS AUTHORITY
FROM PAY.** (G)
ACCESS INTENT(UPDATE ) ACCESS ALLOWED(READ )