A user with READ Access to a catalog DATASET will receive:
TSS7227E ALL Access Not Granted to Dataset
Even thought the user only wants to read the dataset the request is for ALL access because the dataset is a catalog. In order to read a dataset it must first be opened. IBM requires ALTER access to open a catalog dataset. The Top Secret equivalent of ALTER access is ALL access. To avoid having this problem give users access to the specific dataset that they need to access within the catalog.