zCX: Personal and technical Userids mustn't be in the same group / results in workflow failures / rerunability

The zCX workflow says for the SAF group to be specified during provisioning:

"Specify an existing SAF group name to allow that group access to this IBM z/OS Container Extensions appliance instance directory. The provisioning user of this IBM zCX appliance instance and the started task user of this IBM zCX appliance instance needs to part of the SAF group."

Our security policy doesn't allow to share groups for personal and technical userids. If the provisioning user is not in the SAF group, the Workflow fails and manual steps have to be taken. Failing jobs are not always rerunable so that for this also manual steps have to be taken. This results in going from z/OSMF Workflow to ISPF, back to z/OSMF and so on.

For the SAF group - the root cause of the failing job: The provisioning userid also mustn't be owner of the provisioned instance. A technical userid (like the zCX STC userid) has to be owner (never ever involve personal userids in technical processes). If the provisioning user leaves the company the technical process has to be reworked manually.

Sysprogs typically should have g:rwx rights on the instance. This could be realized with e.g. file/directory default ACLs. The provisioning user could then be in the SAF group for the created files.

Coming to security and the workflow, there are too much manual steps. IBM says that they don't provide the required information to do this without Workflows. But if you say Workflows have to be used, they should provide the required ability to fullfil all requirements regarding security and so on.