According to the racf team here (I don't have access) we have configured racf as you said. BTW: we do not have a userid calls tools only a files pace.
Here is the RACF output VLB2 ACTIVE CLASSES = DATASET USER GROUP VMMDISK VMRDR VMCMD VMNODE VMBATCH VXMBR VMXEVENT GENERIC PROFILE CLASSES = VMBATCH GENERIC COMMAND CLASSES = VMBATCH GENLIST CLASSES = VMBATCH Sysv ACTIVE CLASSES = DATASET USER GROUP VMMDISK VMRDR VMCMD VMNODE VMBATCH VXMBR VMXEVENT GENERIC PROFILE CLASSES = VMBATCH GENERIC COMMAND CLASSES = VMBATCH