Define the complete group structure, user roles, and access levels 2. **Dataset security** — RACF profiles for all production datasets, with encryption designations 3. **DB2 security** — Connection control (DSNR), authorization model (GRANT/REVOKE), column-level encryption for sensitive data 4. **CI