Command Verifier has a concept of command replacement, or in this case command completion, controlled through C4R.command.=PSTCMD.keyword profiles. A profile C4R.ALTUSER.=PSTCMD.RESUME could be used to define a post command like ALTUSER xxx CSDATA(NOPSWDREV)) and a PERMIT READ/UPDATE/CONTROL on this profile would cause the post command to be executed. NONE prevents the post command.You could use zSecure Alert to set the PSWDREV field, for example to the date when the user got revoked. Look at alert 1104. This trigger on EVENT=RACINIT qualifier 7, the SMF record RACF issues when the number of incorrect passwords exceeds the SETROPTS threshold. zSecure Alert has an Action Command option, where you compose your 'ALTUSER' user 'CSDATA(PSWDREV(' | date time ')' command. The C2POLICE user ID must have FIELD level access to set the field, of course.In olden days, RACF installations also used the concept of Hard revoke and Soft resume. This is implemented in zSecure Admin with CKGRACF SCHEDULES. The security officer that wants to block a user issues CKGRACF USER xxxx SCHEDULE BLOCKED NOW REASON "Security incident" or goes through the panels to generate this (e.g. RA.U, MS "manage schedules" line command). The Admins use RA.H "Helpdesk" to issue a CKGRACF USER xxx RESUME command to resume a user. If the user has a SCHEDULE blocking the RESUME, they get a nice little message.