How do I restrict which MVS commands a user can enter?

Define RACF profiles in the OPERCMDS class. Here is an example showing how to allow display commands to be issued by all users, but restrict all other MVS commands to a specified group:

SETROPTS CLASSACT(OPERCMDS)
SETROPTS GENERIC(OPERCMDS)
RDEFINE OPERCMDS MVS.* UACC(NONE)
PERMIT MVS.* CL(OPERCMDS) ID(groupid) ACC(READ)
RDEFINE OPERCMDS MVS.DISPLAY.* UACC(READ)
SETROPTS RACLIST(OPERCMDS) REFRESH