prevent user from modifying the SOA record in DNS zone

What should you do to to prevent Rory Allen from modifying the SOA record in the Domain.com zone?