Exempt

Enhanced Definition

In the context of z/OS, "exempt" refers to a specific entity (such as a user, resource, or process) being explicitly **excluded from a general rule, policy, or system behavior** that would otherwise apply. This allows for exceptions to standard security controls, resource management policies, or operational procedures, providing flexibility in system management.

Key Characteristics

- Rule Override: Explicitly bypasses or modifies the application of a predefined system rule, policy, or default behavior.
- Granularity: Can be applied at various levels, from individual users, datasets, or volumes to entire workloads, job steps, or system components.
- Configuration-Driven: Requires specific configuration within system components like security managers (e.g., RACF), Workload Manager (WLM), or data management systems (DFSMS/HSM).
- Potential Risk: If not carefully managed, exemptions can introduce security vulnerabilities, resource contention, or operational inconsistencies, requiring careful oversight.
- Auditable: The creation, modification, and application of exemptions are typically logged and auditable, which is crucial for compliance and security reviews.

Use Cases

- Security Access: Granting a specific RACF user or group UPDATE access to a critical production dataset that is generally restricted to read-only for all other users.
- Data Migration: Marking a critical VSAM dataset as EXEMPT from automatic migration by DFSMS/HSM to ensure it remains on primary storage for performance-sensitive applications.
- Workload Management (WLM): Defining a specific WLM service class as EXEMPT from certain resource capping rules to ensure critical online transactions always receive priority CPU and I/O.
- JCL Processing: Using a DD statement parameter like DISP=(NEW,CATLG,DELETE) where DELETE is an exemption from the typical KEEP behavior on job abend, ensuring automatic cleanup of temporary datasets.
- System Utilities: Specifying an EXEMPT or TOLERATE parameter in a utility (e.g., IDCAMS) to allow it to continue processing despite encountering minor errors that would normally cause termination.

Related Concepts

Exemptions are intrinsically linked to security authorization systems like RACF, ACF2, and Top Secret, where access rules are defined and exceptions can be granted to users or resources. They are also critical in Workload Manager (WLM) policies, allowing specific service classes to be prioritized or excluded from resource constraints to meet service level objectives. Furthermore, DFSMS (Data Facility Storage Management Subsystem) and its components like HSM (Hierarchical Storage Manager) utilize exemptions to control data placement, migration, and backup policies for critical datasets.

Best Practices:

Justify and Document: Every exemption should have a clear business justification and be thoroughly documented, including its purpose, scope, and expiration (if applicable).
Least Privilege: Apply exemptions using the principle of least privilege, granting only the minimum necessary access or deviation from the rule for the shortest possible duration.
Scope Limitation: Limit the scope of an exemption as much as