15.1 Delegated RACF administration15.1.1 Implementing zSecure Admin scoping15.2 Ensuring system integrity15.2.1 Enforcing standards15.2.2 Preventing unwanted SETROPTS changes15.2.3 No profiles in WARNING mode15.2.4 No high UACC15.2.5 Preventing or allowing elevation of authority15.2.6 Lockdown profiles for segregation of responsibilities15.2.7 Additional controls required for group special users15.2.8 Assigning mandatory values15.3 Processes for managing authorization15.3.1 Timed (queued) commands15.3.2 Temporary (queued) commands15.3.3 Workflow for RACF commands15.3.4 Access re-validation reporting15.4 Reporting processes15.4.1 Advanced use of CARLa for email bundle reporting15.5 Joiners, leavers, and movers processing15.5.1 Flagging users for revocation, revoking them, and changing ownership of those users15.5.2 Reporting on deleted user IDs15.5.3 Leavers processing15.5.4 Joiners processing15.5.5 Movers processing15.6 Segregation of duties15.6.1 Separating administrators by specialized function15.6.2 Conflict detection in permits/roles15.6.3 Mutually exclusive access reporting15.7 Conclusion