EDRSQL server requires QUSER *RWX authority to ROOT

We recently secured our ROOT directory in the IFS; however, when the EDRSQL server job (QXDAEDRSQL) starts up; MSG CPE3401 is shown in the joblog and the job ends. (see attached joblog)

The Security Audit Journal records an Authority Failure (AF) identifying QUSER and the ROOT directory as the object failing (see attached)

We determined that adding QUSER with *RWX and *NONE allows the EDRSQL server job to startup.

However....
Adding the communications default user profile (QUSER) to have full control over the ROOT directory is problematic.... Might you have a suggestion on how to accomplish this task without exposing our entire ROOT directory to the QUSER user profile?

Holly Rademacher (IBM) suggested that we could grant authority to QUSER before starting the service, and then remove authority once it's started. Kinda hokey, but it would work....

My code

0067.00 /* Start TCP

0068.00 QSYGETPH PRFHDL(&curprfhdl)

0069.00 QSYGETPH USER(qsecofr) PRFHDL(&secprfhdl)

0070.00 QWTSETP PRFHDL(&secprfhdl)

0071.00 STRTCP

0072.00 DLYJOB DLY(20)

0073.00

0074.00 /* Restart with correct auth

0075.00 ENDTCPSVR SERVER(*edrsql)

0076.00 DLYJOB DLY(10)

0077.00 CHGAUT OBJ('/') USER(QUSER) DTAAUT(*rwx)

0078.00 STRTCPSVR SERVER(*edrsql)

0079.00 DLYJOB DLY(10)

0080.00 CHGAUT OBJ('/') USER(QUSER) DTAAUT(*none) OBJAUT(*none)

0081.00 QSYRLSPH PRFHDL(&secprfhdl)

0082.00 QSYRLSPH PRFHDL(&curprfhdl)