TMS always permits read access to all volumes by all users. N.B. this may not be the case outside CERN!
Write access is normally allowed to all members of the account group owning the volume, but access may be restricted by using PROTECTION GROUPS. A protection group allows access to be limited to a small number of individuals or extended to members of other groups. The QUERY VID command gives the name of the protection group governing write access to a volume and the QUERY PROTECT command can be used to see the users permitted access by a given protection group.
The owner of a volume (or an authorised user for 'pool' volumes) may globally disable write access using the LOCK command - a software equivalent of the "Do not write on this tape" sticker. This functionality is provided by the routine FMLOCK. Volumes may be unlocked using the routine FMULOK. LOCK and UNLOCK commands also exist in the FATMEN shell.