I finally finished some initial code for the access control job (ACJ) to detect and report spying.  The documentation and monitor code for TLINK% were confusing enough that I initially just write wrote some code to break out what was being sent so I could figure out how it all worked.  Some random things I found of note: When a job is first created and the EXEC is getting cranked up, it calls TLINK% called to refuse links, viz: 9-Apr-2022 18:06:21 ACJ: TLINK% SAB:CLR Obj:-1 by job 10, user not logged in user, program  , TTY46 The -1 argument for the object means, "My Terminal", in this case TTY46 is being conditioned to refuse links.  On a batch login, I refuse links and advice, as can be seen by the below:  8-Apr-2022 23:29:18 ACJ: TLINK% STA:CLR Obj:-1 by job 11, user SLOGIN, program TERMIN, TTY21  8-Apr-2022 23:29:18 ACJ: TLINK% SAB:CLR Obj:-1 by job 11, user SLOGIN, program TERMIN, TTY21 The EXEC commands which did this are: Terminal (feature or type) NO Receive Advice Terminal (feature or type) NO Receive Links The batch job in question was MONGEN, because I'm in the middle of tweaking a few things in the TLINK% JSYS code to make my life easier in the ACJ.  Since I'm impatient, from the following you can see that I did an ^Epeek to watch the batch job execute:  8-Apr-2022 23:29:21 ACJ: TLINK% ERO Obj:-1 Rem:21 by job 10, user SLOGIN, program EXEC, TTY46 The regular (non-debugging) code which displays this is less nerdy and maybe easier on the eyes, viz:  8-Apr-2022 23:29:21 ACJ: SPYING: user SLOGIN, Job 11, TTY21 by job 10, user SLOGIN, program EXEC, TTY46 Maybe I'll put in some extra code to break out whether one of them is batch or the line type.  Or something. Right now, I'm just making the JSYS code in TTYSRV easier for me to work with.  Some of it dates back to TENEX days and it's been modified to the extent that I found it confusing to work with (but that's me). The actual problem is that the GETOK% is called before the arguments are resolved.  It is not explicitly laid out in the JSYS reference manual that, unlike the first terminal argument (which must be a terminal designator), the second can be a JFN, which is worthless outside of job context.  So it needs to get converted to a line number before it gets handed to the ACJ.