Insert returns 403 even though my RACF user can update the file

I can update this KSDS from a batch job with the same user. Insert from the workbench returns 403. RACF looks fine.

RACF is necessary and not sufficient. The write surface is off unless it has been opened for that API. Read-by-key is not write-gated. A valid RACF user plus a closed write surface is still a 403 on insert, update, delete, or create. Open the write path only for the datasets that should accept writes, and remember CICS may already be a writer on that KSDS.