Conditional access information doesn't appear in the ICH408I message

Testing conditional access such as: WHEN(CRITERIA(SERVICE(service name))), found that when a user attempts to access the key and does not have the conditional access permitted to a certain service, the normal ICH408I msg is displayed, but there is not mention of the service that is attempting to be accessed.

For example:
Running ICSF WD#18, HCR77D0 on z/OS V2R3. Testing EPIC 196549 –SAF Conditional Access.

We setup the following:
RDEF CSFKEYS &CSFSYS.GEOFFREYJAESCLEARKEY2018 OWNER(CSFADM) UACC(NONE)
SETROPTS RACLIST(CSFKEYS) REFRESH
RDEFINE XFACILIT CSF.CSFKEYS.CONDITIONAL.ACCESS.CONTROL
SETR RACLIST(XFACILIT) REFRESH

PERMIT &CSFSYS.GEOFFREYJAESCLEARKEY2018 CLASS(CSFKEYS) ID(DBXGSYS) ACCESS(READ) WHEN(CRITERIA(SERVICE(CSFBRCK)))

We then attempted to use a different ICSF service, other than CSFBRCK. When we did this, we received msg:
ICH408I USER(DBXGSYS ) GROUP(SYS1 ) NAME(JOHN)
Z1.GEOFFREYJAESCLEARKEY2018 CL(CSFKEYS )
INSUFFICIENT ACCESS AUTHORITY
FROM &CSFSYS.GEOFFREYJAESCLEARKEY2018 (G)
ACCESS INTENT(READ ) ACCESS ALLOWED(NONE )

There is no indication of the service that is attempting to be accessed. I expected to see the service in a message (ICH408I?) which I normally would if attempting to access a service not involved in SAF Conditional access (in that case it would be an ICH408I msg w/ CL(CSFSERV) displayed).

Note that in emailing w/ Mark Nelson, he indicated the following:
Conditional access list entries such as WHEN(PROGRAM(....)) or WHEN(CRITERIA(....)) can never deny access, they can only allow access. That's why the conditional access information doesn't appear in the ICH408I message.

Writing up this requirement to have conditional access information displayed in the ICH408I msg. For example:
ICH408I USER(DBXGSYS ) GROUP(SYS1 ) NAME(JOHN)
Z1.GEOFFREYJAESCLEARKEY2018 CL(CSFKEYS )
INSUFFICIENT ACCESS AUTHORITY
FROM &CSFSYS.GEOFFREYJAESCLEARKEY2018 (G)
CRITERIA(SERVICE=CSFKRR)
ACCESS INTENT(READ ) ACCESS ALLOWED(NONE )