CA7 to prohibit users to use commands DEMAND and RUN, but only allow users to use commands DEMANDH and RUNH.
Since the same resource name L2QPDMND is used for both DEMAND and DEMANDH and the same resource name L2QPRUN is used for both RUN and RUNH.
How to define the RACF profile to limit DEMAND and RUN.

Release:
Component: 7

Regarding wanting to prohibit users to use commands DEMAND and RUN, but only give the users DEMANDH and RUNH.
A way to do this is to define a new resource within member SASSTRAN in the CAL2SRC library.
 
By default, you should have the following:
 
DEMAND,SPO0,10,ESNAME=L2QPDMND
DEMANDH,SPO0,10,ESNAME=L2QPDMND
and
RUN,SPO0,10,ESNAME=L2QPRUN
RUNH,SPO0,10,ESNAME=L2QPRUN
 
-
Since the DEMAND/H and RUN/H commands uses the same resource, disabling access to one will disable both.
You will have to either define a different resource name for those commands and have your Security Administrator restrict the new resource created for DEMAND in RACF.
 
For example:
 
DEMAND,SPO0,10,ESNAME=L2QPDMND
DEMANDH,SPO0,10,ESNAME=L2QPDMNH
 
RUN,SPO0,10,ESNAME=L2QPRUN
RUNH,SPO0,10,ESNAME=L2QPRUNH
 
-
After you modify the SASSTRAN module, you will have to reassemble and link it for the changes to take affect.
See the AL2UM08 usermod within CAL2OPTN.