CICS transaction gets -922, P.auth always CICSUSER

New CICS DB2 program on a fresh region. SQL works from batch binds but the transaction always fails with -922 and SQLERRMC mentions user authorization. EDF shows P.auth as CICSUSER no matter which RACF id I sign on with.

Plan has EXECUTE granted to PUBLIC in the DB2 catalog. Region does not use RACF signon yet. What did we miss in DB2CONN setup?

Without RACF signon CICS uses the region default for DB2 auth. You need the ids added to the CICS attachment or turn on SEC and signon so the transaction runs under the user.

Admin added SEC=YES and surrogate profiles. -922 gone. Should have started there.