What access is needed to allow an SCA ACID to reset the password for the Master (MSCA) ACID?
To set a new password for the MSCA using TSS ADDTO or REPLACE, an SCA must have UPDATE access to entity TSSCMD.USER.cmd.MSCAPW in the CASECAUT class, where 'cmd' is the command being issued.
For example:
TSS PERMIT(sca_acid) CASECAUT(TSSCMD.USER.REPLACE.MSCAPW) ACCESS(UPDATE)
or
TSS PER(sca_acid) CASECAUT(TSSCMD.USER.ADD.MSCAPW) ACCESS(UPDATE)
https://techdocs.broadcom.com/us/en/ca-mainframe-software/security/ca-top-secret-for-z-os/16-0/administrating/creating-security-administrators/restricted-administrative-authorities-casecaut-resource-class.html