Executing OPS command via the HMC:
]OI STATESET STCTBL.EMCINIT DESIRED(DOWN)
The security rule fails and the command is not executed because the value of OPAUUSID is set to 'INVALID':
*-* 120:trace i
OPS0997T *-* 122:racfrc = 20 /* RACF RC: Only 0 = RETURN ACCEPT */
OPS0997T >L> 20
OPS0997T >>> RACFRC=20
OPS0997T *-* 123:smfrecording = 'NO' /* SMF recording: YES or NO (default NO) */
OPS0997T >L> NO
OPS0997T >>> SMFRECORDING=NO
OPS0997T *-* 124:userid = SEC.opauusid /* Userid which entered command */
OPS0997T >V> OPAUUSID
OPS0997T >V> INVALID
OPS0997T >>> USERID=INVALID
OPS/MVS Release : 14.0
Include code in the rule to bypass the security call if the userid is "*INVALID*" and the console name is the one of the HMC.