Learn it on Mainframe Path. Do it with MainframeKit.Learn on Mainframe Path ▸
MainframeKit

SAF-RC-4

SAF return code 4: no decision madeSAF / RACF RETURN CODE

The security request was not processed: neither accepted nor refused. Usually no profile covers the resource, or the class or router entry is not set up.

MOST LIKELY

No RACF profile exists for the resource.

FIRST CHECK

Check the resource name and class used by the application.

TRY IT ▸

Site search

What it means

SAF return code 4 means the SAF router and RACF did not give a yes or a no. Callers must decide what to do, and many applications treat it as a failure or as allowed, depending on their design.

For REQUEST=AUTH it is often seen when a resource is not protected by any profile, so applications relying on a profile see unexpected results.

Typical causes

  • No RACF profile exists for the resource.
  • The class is not defined to RACF.
  • The SAF router is not active, or the router table gives no action for this request.

How to fix it

  1. Check the resource name and class used by the application.
  2. Ask the security team whether a profile should protect this resource.
  3. Check that the class is defined and active (for example with the RACF SETROPTS LIST command, run by an authorized person).
  4. Read the application documentation for how it treats this result.
  5. Do not rely on missing profiles as protection; ask for the right profile.

Example

Illustrative only; names and values are invented.

RACROUTE REQUEST=AUTH,CLASS='FACILITY',ENTITY=PAY.APP.REPORT
  -> R15 = 4   (no profile found, no decision)