How can ACF2 be used to protect access to DB2, but not to protect the DB2 resources?
Access to DB2 can be protected using the DSNR class resources of sysid.DIST, sysid.RRSAF, and sysid.WLMENV.wlm_environment. Write standard ACF2 MVS resource rules for these resource names, using a type code you defined in a CLASMAP record that maps DSNR to xxx.
These resource rules would control access to the DB2 regions/ssids/sysids and would allow DB2 to continue to protect its internal resources.