Thanks, Eileen; what you say makes sense.
I was a little puzzled that no one responded right away; as you say, there must be other REXXers out there who've encountered this. But today I tried a few other things to fix the problem, and my program started behaving strangely, apparently carrying out its instructions in the wrong order. I took the hint and started thinking it through very carefully, then modified the code and laughed out loud: There wasn't a problem, after all.
In case anyone's curious, the program (named ODSN) works in two different ways. First I call it:
tso odsn hlq
...and it displays a WHOHAS listing for DATASET(hlq.). I look it over and if I'm satisfied I can proceed I then call it as an Edit macro:
odsn
In that mode ODSN reads the WHOHAS listing, gets the HLQ (so I don't have to retype it), makes sure that profile-1 has ALL access to hlq, and issues a PERMIT for profile-2. Then it issues another WHOHAS listing, so I can confirm the results before manually revoking profile-1's access.
As I said, the problem appeared to be that the permission wasn't showing up in the second WHOHAS; the PERMIT was successful, but I couldn't see it until the program finished and I issued another WHOHAS manually. Appearances were deceptive, though; the real problem, apparently, is that I'm a doofus. I was still looking at the first WHOHAS listing; the new one was still waiting in the wings, so to speak.
So I'm glad you folks didn't have to research this :-).