A performance issue can have security implications when a user with the right special authorities on their profile abuses their assigned priviledges and consumes excessive system resource in their own interest.
Controlling the execution priority of a job is a function of the Job Priority, which is set by the Job Description. It can also be changed by a user with *JOBCTL special authority. You might want to just remove *JOBCTL from their user profile. Restricting access to the CHGJOB command can also help. The CHGJOB command is shipped from IBM with public access set to *USE, so any user profile can use it. Restricting access could affect applications running on your system, so you should consider this change carefully.
To restrict access to the CHGJOB command, run the following command on your system:
GRTOBJAUT OBJ(CHGJOB) OBJTYPE(*CMD) USER(*PUBLIC)
AUT(*EXCLUDE)
This will change the command so that only authorized user profiles can use it. To add a user profile to those allowed access to this command, use the following command:
GRTOBJAUT OBJ(CHGJOB) OBJTYPE(*CMD) USER(MYUSRPRF)
AUT(*USE)
This will allow the profile MYUSRPRF to use this command while excluding all others. Of course, any user profile with All Object Authority (*ALLOBJ) will still have access.
Also consider limiting accesss to the "Change Shared Storage Pool" (CHGSHRPOOL) command. This command can be used to control performance characteristics for jobs running on your system through the allocation of memory resources and processing time slices.
Interactive batch jobs can also impact performance. Use "Change Command" (CHGCMD) to prevent batch jobs from running interactively. Set the ALLOW parameter to remove the *INTERACT, *IPGM and *REXX options.
*NOTE: track changes to IBM i OS commands, as PTFs or OS upgrades can revert settings.
