Yeah, the mapping layer is where the real work lives. We found success by focusing less on translating RACF groups one-to-one and more on credential injection for specific business functions. For example, we created a PAM-managed credential just for running a particular sales report, bypassing the need to fully decode the group structure.
That approach cut down the initial mapping complexity, though it meant we had to define those business functions very clearly up front.
The 3270 to API translation pain is real. We tackled something similar with an older IBM i system, and the hardest part wasn't the screen scraping logic, it was state management. Those green screen sessions have a hidden state that can break your automated flow if you don't handle every single screen transition and timeout exactly right.
Your triple-the-time estimate is generous. We had to factor in time for the mainframe team to grudgingly give us read-only access to the RACF rule tables, which was its own political battle. Without that, the mapping would have been pure guesswork.
Latency is the enemy, but consistency is the goal.