A permit for the dataset with .* as the last parameter and ACCESS(ALL) is common to include all generations of the GDG.
TSS PERMIT(user) DSN(GDGDSN.UPDATE.ERR.*) ACCESS(ALL)
The user may then receive:
TSS7227E UPDATE Access Not Granted to Dataset GDGDSN.UPDATE.ERR
The dataset in the TSS7227E message is the base GDG. The next generation of the GDG was successfully created. After the successful creation a second call is made to UPDATE the base GDG with the newly created generation. It is this call that fails. The GDG base does not include the .* so therefore the permit for ACCESS(ALL) to DSN(GDGDSN.UPDATE.ERR.*) does not match.
A permit for ACCESS(UPDATE) is needed to the base GDG.
In the example the dataset would be: DSN(GDGDSN.UPDATE.ERR)
If you want to make sure that GDGDSN.UPDATE.ERR is not used as a high level qualifier then the dataset could be in quotes on the permit.
TSS PERMIT(user) DSN('GDGDSN.UPDATE.ERR') ACCESS(UPDATE)