What is happening is from a sign on screen if a user clears it and is not logged on then a CEMT command can be issued.
Release : 16.0
Component : CA ACF2 for z/OS
Adding the ACF2/CICS option in the SIGNON record of REQUIRE=YES will require the users to be signed on to enter all transactions except for a SAFELIST transaction.
For more information on the SIGNON record in the ACF2/CICS interface, go here: