What does ICH408I mean?

A RACF message that says you are not allowed to do that to that dataset. It shows what you asked for and what you have.

ICH408I

RACF says your user ID is not allowed to do that to that dataset.

Also written INSUFFICIENT ACCESS AUTHORITY, RACF VIOLATION

Why it matters. Every wall in the bank is a RACF rule. Reading this message tells you which rule, and what level you'd need.

Syntax

ICH408I USER(userid) GROUP(group) NAME(name)
  dsname CL(DATASET) VOL(volser)
  INSUFFICIENT ACCESS AUTHORITY
  FROM profile (G)
  ACCESS INTENT(level)  ACCESS ALLOWED(level)

INTENT above ALLOWED: Ask the owner of the rule for a PERMIT at the level you need.
FROM profile: The rule that decided. Ask about that one.
Profile is generic (G): One rule covers many names. Permit the rule, not the dataset.
Wrong ID or group: Check who you are logged on as and which group is current.
Dataset is not yours: Use a dataset under your own first qualifier.

Try it ICH408I

1
Place the loader from your DEV library into the bank's TEST library as well. This will be refused.
COPY 'ZB0001.DEV.JCL(LOADCUST)' 'ZBANK.TEST.JCL(LOADCUST)'
2
For today's release, you hold the authority to change the rule ZBANK.TEST.**. Give your own ID UPDATE on it.
PERMIT 'ZBANK.TEST.**' ID(ZB0001) ACCESS(UPDATE)
3
Try the same COPY again.
COPY 'ZB0001.DEV.JCL(LOADCUST)' 'ZBANK.TEST.JCL(LOADCUST)'

ZedBank practice system

READY

Nothing here is saved

Remember

ICH408I is RACF refusing. Read INTENT against ALLOWED.
The FROM line names the rule that decided.
The fix is a PERMIT from someone with authority. Never a trick.

The usual mistake

Trying the same command again and again

RACF gives the same answer each time. Nothing changes until the rule changes.

Read ACCESS INTENT and ACCESS ALLOWED, then ask for a PERMIT on the FROM rule

On real z/OS

Real ICH408I also prints the disk volume (VOL(...)) on the dataset line, and two spaces between the INTENT and ALLOWED parts. MF/OS leaves the volume out. A real PERMIT needs authority over the rule, and who may run it is decided by a security administrator. COPY is not a TSO/E command: it is a Mainframe101 sim: shortcut for what ISPF option 3.3 or an IEBCOPY job does. In an IEBCOPY job the same refusal shows as ICH408I in the job log, with IEC150I 913-38 and an abend S913. On real z/OS you cannot PERMIT yourself access without the authority over the rule, so this step gives it to you.

Where can I practise fixing ICH408I?

Right here, at ZedBank. You take a junior job at a simulated bank, meet ICH408I in real work and fix it, with Zed beside you. There's nothing to install.

Start at ZedBank