It is difficult to ensure that the USERID is given untouched to CFT prior the RACF control when a MODIFY command has been issued from the console or other interface application.
Many options exist but results may not ends as expected depends from where is issued the Modify command.
For that reason, with all older CFT versions, MODIFY commands are executed under the USERID associated to the CFT task.
Because it was not enough flexible when users make use of MODIFY commands issued from different interfaces, CFT product has been enhanced so the administrator can decide what rule should apply for Modify commands:

New parameters in macro SGINSTAL (Job A12OPTS) has been introduced since 2.4.1 SP10 P8            
MCSOPT = {CHECK|MONITOR}
         >---<
  How Transfer CFT is adding a user id to a Z/OS              
      MODIFY command:  

  CHECK: The console name is checked for a valid              
         Security definition, and is used if yes.  
         Else the user id associated with the monitor is used.
         SAF checking applies only if Transfer CFT is running  
         APF authorized.  

  MONITOR: The USERID associated with the monitor is always used.                                              

  -------------------------------------------------------------

SDSFOPT = {USER|MONITOR|IGNORE}
          >--<  
  How Transfer CFT is processing a MODIFY command issued      
  From SDSF:          

  USER: The console name defined in SDSF options is used as the user id issuing the command.                  

  MONITOR: The USERID associated with the monitor is used.  

  IGNORE: MODIFY commands issued from SDSF are ignored.      

   -----------------------------------------------------------

EMCSOPT = {USER|MONITOR|IGNORE}                              
           >--<  
   How Transfer CFT is processing a MODIFY command issued from a program using SVC 34 :                              
 
   USER: The left 8 bytes of EMCS console name are used as the user id issuing the command.                  

   MONITOR: The USERID associated with the monitor is always used.  

   IGNORE: MODIFY commands issued from SVC 34 are ignored.    

   -----------------------------------------------------------

Notes for MCSOPT, SDSFOPT, EMCSOPT:                          

   A user id is added only to CFTUTIL commands,              
   The Z/OS PAUSE command is interpreted as a CFTUTIL SHUT FAST=YES command.                                      
                                                               
   Transfer CFT diagnosis commands aren't associated with a user id.                                                    
   I.E.: MODIFY cft, ECHO                                        
                                                               
                                                               
New messages:                                                  
------------                                                    
SGOP06E: SDSF CMD ignored                                        
SGOP05E: EMCS CMD ignored                                        
                                                               
SGOP12W:MCS             forced  to Userid=yyyyyyy              
or                                                              
SGOP12W:MCS ID=xxxxxxx  forced to Userid=yyyyyyy