RE: File protection basics

You're probably right that most objects are probably wide open to the users and you would not experience many issues if you removed *ALLOBJ and *SAVSYS. If you're printing confidential information you may way want to separate that by output queue and secure the output queue since you are using *SPLCTL.
It wouldn't be too hard to create test users and run them through the process.

In an effort to "seek first to understand" I am trying to determine why the users would have *ALLOBJ and *SAVSYS. Do you have programs which save and/or restore which are used by the general public? For example:
- empty skeleton files restored to QTEMP from a save file
- A save of data before a critical process
- saving of data to send to another system
Because sometimes people only but casually glance at the messages and start shotgunning solutions. This would explain people having those two special authorities. The save and restore commands are public *use. The help for SAVOBJ also states this:
If you do not have *SAVSYS special authority, only those objects
that you have authority for are saved.

Since you are at 7.1 you do not have the "authority collection" capability supported with 7.3 and enhanced with 7.4 so that makes it a wee bit tougher to analyze current users and see what would happen if you lowered their special authorities.

You also probably do not have access to many of these services:
https://www.ibm.com/support/pages/node/1119123


Rob Berendt