why not assigned only certain users to hv those authorities? create something like trigger whenever user use the “CHGUSRPRF” command. Or secure the “CHGUSRPRF” command by a user group (or userid like your own userid) and limit the users who can have access to this command.

in as400 everything is an object, so search for the “CHGUSRPRF” object and add an authority list on top. Take out the special authorities from all those irresponsible users and realigned who can be given those authorities in their as400 profiles

if everybody screams go to your boss and push through a “reform”