A TSO user ID and password, a CICS sign-on, or a DRDA connection with user ID and password. 2. **z/OS passes credentials to RACF** — The operating system calls RACF's authentication service (RACROUTE macro). 3. **RACF validates identity** — Against its own database of user profiles, group membership