As an old IBM i (AS/400-class) administrator, I like this Patrick Botz article on IT Jungle. about expanding the limits of a user’s Limit Capabilities setting.
In it, Patrick shows you how to allow users whose Limit Capabilities parameter (LMTCPB) is set to *NO to execute specific commands they otherwise would not be able to execute on a command line. He walks you through creating an exception for allowing users to execute just one green-screen command while blocking them from running all other restricted commands.
Cool stuff. You can read Patrick’s article here.