We have more than one company accessing our production 3K. An
application vendor wants to be able to backup (to disc) the IMAGE files
in their account. I want to limit our exposure. As I understand it, to
backup IMAGE files, they need OP or SM (as if) for backup, PM for IMAGE,
and UV for volume set access (or do they only need that to cross volume
sets?).

I thought of creating a user with only Batch Access, no InterActive, so
they will at least leave a STDList (we have NSD storing all STDLists,
and they don't have access to cover any tracks). I don't want to add PM
to their account. So I have created a password protected user in SYS,
with CAP=BA,OP,PM,UV, and nothing else. They can then stream a job under
this id, having to provide the user password.

What haven't I thought of? Can anyone improve on this, or offer a better
solution? I would like to stay with pure MPE; although we are using
SEC/3K, I would prefer not to use MPEX unless doing so buys me a lot.