Does anyone else use an ACD on their SYSSTART?

I was looking at system startup procedures, and was surprised that our
SYSSTART does not have an ACD. This seems like a vulnerability to me. I
would think that one would only want the SM to have Read & Write access.
EXecute seems to be the tricky part; I would still think that that
should be limited, but am less sure how. What id does the system boot
under? I am reluctant to tinker with this without learning more first. I
feel that I should know this already, but haven't needed to boot the
3000s that I have been around, and now they are in another state, so I
can't just 'try it and see'.