Example 6-22 Give CONTROL access if you have an existing generic VMBATCH profile: RAC PERMIT CLASS(VMBATCH) ID(VSMWORK1) ACCESS(CONTROL) RAC PERMIT CLASS(VMBATCH) ID(VSMWORK2) ACCESS(CONTROL) RAC PERMIT CLASS(VMBATCH) ID(VSMWORK3) ACCESS(CONTROL) RAC PERMIT CLASS(VMBATCH) ID(DTCSMAPI) ACCESS(CONTROL) Although all of the items that are described here are important, they are not enough without  validating them. Auditing SMAPI requests ensures that the security policies that are applied  are being followed and are correctly assigned. SMAPI provides the following Enterprise Security Manager (ESM) interaction: z/VM Cloud Manager Appliance (CMA) allows the use of OpenStack to deploy Linux guests  on z/VM, and for the integration of z/VM into larger environments. The current CMA version is  on OpenStack Newton and is supported as a z/VM component without extra license  requirements.  CMA manages only z/VM platforms and it does not deploy guests onto non-z/VM platforms.  The CMA changes provide several different options for using CMA: as stand-alone cloud or  integrated with another OpenStack environment. This section refers to the current version of z/VM CMA Newton. Note:  Consider the following points: GLYPH<SM590000> To get the CMA Newton package, you must contact your IBM representative or IBM  account team.  GLYPH<SM590000> CMA Newton is available for z/VM v7.1 for the specific use case with IBM Cloud Private  only. GLYPH<SM590000> The support for CMA Newton version on z/VM v7.1 is a transitional offer until a strategic  long-term solution to replace the CMA becomes available. – SMAPI treats the request as unauthorized – The SMAPI authorization decision uses th e existing authorization process. SMAPI  calls the ESM to log the decision in the ESM-managed security log. SMAPI has no  knowledge if the ESM audit logging is enabled or disabled. GLYPH<SM590000> When an ESM defers its authorization decision to SMAPI, one of the following actions is  taken based on a configuration option: GLYPH<SM590000> When an ESM is present, programs can use the ESM for all SMAPI authorization  decisions at the same granularity that is used with the SMAPI existing authorization  mechanism. The ESM logs (or does not log) the decision that is based on its active policy,  without SMAPI knowledge or intervention. SMAPI ESM authorization support 6.4 z/VM Cloud Manager Appliance 174  Securing Your Cloud: IBM Security for LinuxONE