Discovery uses the netstat command to access network information. To do this, the NETSTAT command must not be present in the AUTHCMD section of the IKJTSOxx PARMLIB member.
You can use RACF rules to control access to netstat by setting READ access for a userid to this resource:
Class: SERVAUTH
Resource name: EZB.NETSTAT.mvsname.tcpprocname
Where mvsname is the name of your z/OS system and tcpprocname is the name of the TCP/IP procedure for the stack you wish to use.