There are some system values that you can lock down to prevent even these users from changing these system values during normal operation.
Most security system values can be altered only by a user with Security administrator (*SECADM) and All object (*ALLOBJ) special authorities. To prevent even these users from changing these system values during normal operation, system service tools (SST) and dedicated service tools (DST) provide an option to lock these security values.
See the Lock function of security-related system values topic to see a list of the system values that you can lock down.