Define which commands belong in a role
Command Security for IBM i is an enquiry around controlling command execution in the intended Powertech configuration. Start with operational tasks and the command paths they use. A restriction that appears safe in an interactive demonstration may affect scheduled work, application menus or support procedures differently.
Build a role-to-task map and distinguish normal activity from exceptional administration. Confirm supported command controls, platform compatibility and the treatment of the relevant execution paths. The objective is a usable authority boundary, not an indiscriminate block on commands the business still requires.
Check both interactive and scheduled workloads
A controlled pilot should demonstrate an allowed command, a prohibited case and an authorised exception. Include representative application and batch contexts where those are in scope. Review resulting evidence with the administrator responsible for the workload rather than interpreting every denied command as an attempted attack.
Changes should retain an approved recovery path so essential support does not depend on guessing which rule caused a failure. Handover needs the policy rationale, supported scope, exception owner and a process for reviewing changes after application upgrades. MMC’s proposed configuration work should identify the commands and roles covered; broader application redesign is a separate engagement.
Evidence to request for this scope
- Confirm the documented execution paths covered by the selected Command Security configuration.
- Test representative allowed and denied commands under the relevant user and job contexts.
- Record rule precedence, exception approvals and a recovery procedure for an unintended restriction.