CPF2189: Not authorized to object

What it means

CPF2189 is an escape message from QCPFMSG with the text "Not authorized to object &1 in &2 type *&3". It is the library and object command version of CPF9802. The object was found, but the authority check on it failed.

Commands that manage objects need more than the right to use them. RNMOBJ needs object management authority (*OBJMGT) to the object, and update and execute authority to its library. CRTDUPOBJ needs *USE and *OBJMGT to the object it copies. Deleting an object needs object existence authority. A user with *CHANGE authority to a file can work with all its data and still be refused a rename, because *CHANGE doesn't include object management.

IBM i takes the user's authority from *ALLOBJ special authority, private authority, group profiles, an authorization list, *PUBLIC, and authority adopted from programs on the call stack. Any of these can be the reason the user had access before and doesn't now.

Common causes

• The user has data rights (*USE or *CHANGE) but not object management or existence authority, which renames, moves, copies and deletes need.
• The object's *PUBLIC authority is *EXCLUDE, and the user has no private or group authority.
• The object was created or restored with different authority, for example under the library's CRTAUT value.
• A program that used to adopt its owner's authority was recompiled or re-owned and no longer adopts it.
• The command runs in a batch job under a different user profile than the person who submitted it expected.

How to find the problem

1. Open the job log with DSPJOBLOG, put the cursor on CPF2189 and press F1. The help shows the object, library and type. The command logged just before it shows what was being attempted.
2. Run DSPOBJAUT OBJ(ACCTLIB/PAYMAST) OBJTYPE(*FILE) to see the authority each user and group holds. Check whether the user's authority includes *OBJMGT or *OBJEXIST, not only *USE or *CHANGE.
3. Run DSPUSRPRF to see the user's group and supplemental group profiles, and compare them with the object's authority list.
4. If auditing includes *AUTFAIL, the security officer can find an AF entry in QAUDJRN that shows the exact object and user.

How to fix it

• Grant only what the command needs. For a rename that is object management, for example GRTOBJAUT OBJ(ACCTLIB/PAYMAST) OBJTYPE(*FILE) USER(DEVOPS01) AUT(*OBJMGT).
• Let the object's owner, or a security officer, run the command instead, if the user shouldn't manage the object at all.
• Prefer group profiles or authorization lists over grants to single users.
• Check the library too. Rename and move commands also need authority to the library, and that failure is CPF2182.

What it looks like

Not authorized to object PAYMAST in ACCTLIB type *FILE.

DSPMSGD MSGID(CPF2189) MSGF(QSYS/QCPFMSG)

Technical reviewer: Albert Joseph, WND Software.

Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s documentation for your IBM i release.