disable user from modifying SOA records

What should you do to to prevent Rory Allen from modifying the SOA record in the Domain.com zone?