Prevent users from specifying the DSKEYLBL= JCL parameter in a batch job with Top Secret.
TSS PER(ALL) IBMFAC(STGADMIN.SMS.ALLOW..ENCRYPT) ACC(NONE)
will prevent users from using the DSKEYLBL= JCL keyword.