How does RACF apply to catalog search and dataset content reads?

Protected APIs use HTTP Basic as the caller’s RACF identity. Catalog search and dataset content reads succeed or fail as that user. /ping and /help.html are unauthenticated.