CPF9820: Not authorized to use library

What it means

CPF9820 is an escape message from QCPFMSG with the text "Not authorized to use library &1". On IBM i a library is an object of its own, of type *LIB, with its own owner, *PUBLIC authority and private authorities. To reach any object inside a library, a user needs authority to the library first and then authority to the object.

Finding an object in a library needs *EXECUTE authority to the library, which *USE includes. Creating an object in it needs add authority as well. Renaming an object needs update and execute authority to its library. When the library check fails, the system stops there and sends CPF9820. It never checks the object, so the object's own authority doesn't matter at this point.

Libraries that hold sensitive data, such as payroll or HR libraries, are often set to *PUBLIC *EXCLUDE on purpose. CPF9820 in that case is security working as designed, and the right fix is a business decision, not a quick grant.

Common causes

• The library's *PUBLIC authority is *EXCLUDE, and the user has no private authority and no group profile that has it.
• The user moved to a new role or a new group profile, and the old group carried the library authority.
• The library was re-created or restored, and the private authorities it used to have weren't put back.
• A program that adopted its owner's authority to reach the library was changed and no longer adopts.
• The job is running under a different user profile than expected, for example a batch job submitted with another USER, or a server job that swapped to the requesting user.

How to find the problem

1. Open the job log with DSPJOBLOG, put the cursor on CPF9820 and press F1. The help names the library. F9 shows the program that received the message.
2. Run DSPOBJAUT OBJ(QSYS/ACCTLIB) OBJTYPE(*LIB) to see the library's owner, *PUBLIC authority, private authorities and any authorization list.
3. Run DSPUSRPRF for the user to see the group profile and supplemental groups, and check whether any of them appear in the library's authority list.
4. Check which user profile the job really runs under with DSPJOB. For a submitted job, look at the USER on SBMJOB or in the job description.

How to fix it

• If the user should have access, grant it to the library, for example GRTOBJAUT OBJ(QSYS/ACCTLIB) OBJTYPE(*LIB) USER(CLERK01) AUT(*USE). The library owner or a security officer has to run it.
• Prefer granting to a group profile or an authorization list, so new users get access by joining a group.
• Grant only *USE unless the user must create objects in the library. Library authority doesn't give any rights to the objects inside it.
• After fixing the library, the next run may stop with CPF9802 if the user also lacks authority to the object. Check the object's authority with DSPOBJAUT too.

What it looks like

Not authorized to use library ACCTLIB.

DSPMSGD MSGID(CPF9820) MSGF(QSYS/QCPFMSG)

Technical reviewer: Albert Joseph, WND Software.

Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s documentation for your IBM i release.