RACF control to allow or disallow copying of data from an encrypted dataset to an unencrypted dataset

Today if a person has access to a key label there are no controls in place to limit their ability to copy an encrypted dataset to a dataset with no DFP segment in it's RACF dataset profile. When this is the case the dataset is unencrypted when writing to the target dataset. For example a bad actor with access to production datasets uses an IBM utility to copy the datasets contents to a non-prod / non-encrypted dataset.

To help avoid the potential of a data breach i would like to suggest a RACF feature which would allow customers a degree of control over this capability. Here are 2 rough options I'd like to have IBM consider.

At a system level - create a RACF FACILITY class profile that when defined would eliminate the ability to read data from an encrypted dataset and write to an unencrypted dataset (with some exclusions such as temp datasets). Only users who have read access to the profile would have the access to perform such an operation.

At a more granular level - create a new field within the dataset profile DFP segment that is mutually exclusive with the KeyLabel (so for datasets that are not encrypted). Any datasets within this profile that have this flag turned on cannot be a target when the source is an encrypted dataset. At least this way the customer can control which datasets are authorized for this purpose and not 'user' type datasets, e.g. &SYSUID.MY.DATASET. Another suggestion was a “NODFP” setting that would disable decryption for utilities including those that transmit files (XMIT, FTP). These would have default settings and require special permissions to override (kind of like tape BLP).

I haven't given this alot of thought there may be other ways to do this, for example within the PROGRAM level, e.g. IEBCOPY, IDCAMS, SORT, etc but that may create new 'opportunities' for a bad actor.