zSecure provides a special DD name for generating CARLa commands: CKR2PASS. When you write CARLa commands into this DD, in ISPF you are shown the commands and you can type GO to execute them.
In batch jobs, procedure C2RC2 can be used to execute the commands in CKR2PASS.
newlist type=racf_access nopage dd=CKR2PASS
select class=group profile='CONSULT'
Sortlist 'COPY USER=' | id(8) 'TOUSER=xxxxxxxx'
Except you probably want to apply some changes to the user ID. You could add a DEFINE command to select the part you want to kee, like so:
newlist type=racf_access nopage dd=CKR2PASS
define partial as substr(id,5) /* copy from position 5 to end */
select class=group profile='CONSULT'
Sortlist 'COPY USER=' | id(8) 'TOUSER=EXTR' | partial(0)
#SupportMigration#ZSecurity#Support