how to prevent user to modify soa record zone

What should you do to to prevent Rory Allen from modifying the SOA record in the Domain.com zone?