Progam versus Token Security

The three things you need to grant access to for every screen that a person needs to access are 1. The Category or CAT (this is the system code AP, GL PO, etc), 2. The Program or PGM (this is the screen name AC10, PO10, etc) and 3. The Token or TKN (this is the actual screen itself, AC10.1, PO10.1 etc) you can write your rules on the PGM or Token and depending on the scenario you may need differing rules for either of these.

Of course there is a fourth and fifth access that is needed and the is the Files access, and the Data Source access without that nothing will work.

Hope that helps and good luck with the implementation. It can be a lot of work but be sure to plan it out in advance and consider the long term maintenance when you build your classes and roles. Take into account how hard it will be if you need to add more screens to a role or class later if the class is shared in too many roles. I recommend not trying to "reuse" security classes within other roles except for the classes that have full access to every screen or file. I would rather have lots of security classes and as minimal amount of Roles as is needed.