IBM states in the Migration from z/OS V2R2 and z/OS V2R1 to z/OS V2R3 Guide:
Beginning in z/OS V2.3, if you activate the RACF SDSF class, you must also enable this class for RACLIST processing. This change is needed to allow the command RACROUTE REQUEST=FASTAUTH to be used with the SDSF class. What is needed in ACF2 for this?
Release : 16.0
Component : CA ACF2 for z/OS
Starting with z/OS 2.3, IBM added FASTAUTH calls to SDSF. If you are validating SDSF using ACF2 instead of internal SDSF security, then the TYPE code being used with SDSF needs to be resident, which means the TYPE code needs to be added to INFODIR.
Example commands to add a Resource TYPE code 'xxx' to the GSO INFODIR:
SET CONTROL(GSO)
CHANGE INFODIR TYPES(R-Rxxx) ADD
F ACF2,REFRESH(INFODIR)
For more information on the Migration from z/OS V2R2 and z/OS V2R1 to z/OS V2R3 Guide