I thought maybe if they are submitting under TSO/ISPF then IKJEFF10 might work. There could be a sample in SYS1.SAMPLIB SUBMIT command IKJEFF10 Check submitted JCL statements and accept, reject, or modify them.
That would not help if they use something like IEBGENER to submit through the internal reader Another product JCL+ from SEA (Software Engineering of America) is also a nice way to scan JCL and not submit. https://www.seasoft.com/jclplus.asp Customizing the SUBMIT command and job output processing z/OS TSO/E Customization SA32-0976-00 Users can issue the TSO/E SUBMIT command to submit batch jobs for processing by JES. They can issue the TSO/E OUTPUT command to process the output of jobs they submit, the TSO/E STATUS command to display the status of any job in the system, and the TSO/E CANCEL command to stop the processing of jobs they submit. By using JES initialization statements, you can change the default processing performed for jobs submitted by TSO/E users, as well as jobs submitted via other methods, such as external readers or ISPF/PDF. You may want to review, and if necessary, change the default processing. You can also use the TSO/E SUBMIT exit, the TSO/E OUTPUT, STATUS, and CANCEL exit, JES exits, SMF exits, and RACFR resource classes to customize jobs and their output before and after they have been submitted. For example, you can: Override the IBM-provided default job processing characteristics Monitor, change, or supplement the JCL users use to submit a job Cancel a job Tailor the way the TSO/E CANCEL, OUTPUT, and STATUS commands work Delete, release, or reroute job output Control who can submit and cancel jobs by job name Protect against unauthorized spool access of the SYSOUT data sets for the TSO/E OUTPUT command Allow users to submit jobs on behalf of another user (job owner) without knowing that user's password Setting defaults for jobs submitted by TSO/E users Customizing how users submit jobs and process the output Writing an exit for the SUBMIT command Writing an exit for the OUTPUT, STATUS, and CANCEL commands Lizette > -----Original Message----- > From: IBM Mainframe Discussion List [mailto:[email protected]] > On Behalf Of R.S. > Sent: Wednesday, August 05, 2015 7:23 AM > To: [email protected] > Subject: Re: submit restriction > > W dniu 2015-08-05 o 14:22, Tim Brown pisze: > > Can submit be restricted to only using TYPRUN=SCAN, we have some > > consultants analyzing our system and they would like to see expanded JCL > but we cant let them execute it. > > There is no "up & ready to use knob", but there are some solutions. > 1. Exit IEFUJI or JESx which enforce such parameter in the jobcard. > 2. Use built-in (z/OS 2.x) jobclass protection and set up "test" class with no > initiator. The cons is the jobs will wait for execution endlessly - someone has > to swap it out periodically. > 3. Last but not least: protect datasets and (optionally) programs and no job > would execute properly. > > -- > Radoslaw Skorupka > Lodz, Poland > > ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
