CICS Named Counter API Commands need security

CICS has a series of API commands to utilise Named Counters:

DEFINE (D)COUNTER

DELETE (D)COUNTER

GET (D)COUNTER

QUERY (D)COUNTER

REWIND (D)COUNTER

UPDATE (D)COUNTER

Looking in the documentation:

Access to named counter pools - IBM Documentation indicates that there are currently two security checks that govern whether a Named Counter Server can access the structure and act as a server for the Pool.

Access to named counter servers - IBM Documentation indicates that there is also a check whether a CICS Region userid can connect to the Named Counter Server. This section also then states:

"When a CICS region has connected to a named counter pool, it can define, update, delete, get, rewind, and query named counters without any further security checks being performed by the server."

and System authorization facility (SAF) responses to the named counter server - IBM Documentation states:

"Access is permitted to any named counter server without a specific DFHCF.poolname profile, or an applicable generic profile. No messages are issued to indicate this. To avoid any potential security exposures, you can use generic profiles to protect all, or specific groups of, named counter servers."

There seems to be no indication of any ability to restrict an individual CICS user manipulating these counter though the CICS API meaning any user can perform changes to any existing counters or create new ones with no checks at all.

There is also a Call interface documented Using the named counter CALL interface - IBM Documentation which appears to be usable within CICS and from batch so a work around appears to be preventing use of the CICS Counter API and writing a user program to enforce security. For example by using EXEC CICS QUERY SECURITY.