Thanks to all for your responses!
 
The consensus favors the online command alternative.
 
I omitted a requirement for the second option as John Diercks noted:
>>Ummmmmm, I hope there's some other restriction besides just X access
 
Yes, there is another restriction. The execute access privilege is only
granted when the job file creator/owner name is the same as the job logon
identity.
 
John Dunlop also suggested an implementation using system variables. I like
the suggestion, however, this will not be implemented with the STREAM feature.
Please continue to express your support for the system variable implementation
at the upcoming IPROF meetings. This item is SIG 95C01.