RE: Athuorization lists

And this is a very good technique.  I believe it's called "Application 
Only Access".  It only has a few concerns.

If your vendor does this, and somewhere nested down the list you are 
granted a command line, then you have the access of the adopted initial 
program.  You can check this by doing a DSPOBJAUT.  If you see yourself 
there with object authority of *ADOPT (or is it *ADOPTED) then that is 
what is happening.

What about the users that are allowed to download data?  Somehow or 
another you have to give them the ability to do so.  (Some Luddites won't. 
 Their's are the systems that are replaced with wintel servers because the 
users can then get to the data, when it wasn't the technologies fault at 
all.)  We used an exit point to only allow them to download a particular 
temp file.  Took them only about an hour to discover that they could copy 
over this file with any data they wanted from a query and still download 
it.

Rob Berendt