Modifying Roles in PRD

Hi all

I've restricted changes to the PRD system through Systems Change Option ie SE06 & Client Change Option ie SCC4. Despite this I notice it is possible for some users to modify roles in PRD via transaction PFCG.

How do I resctricted access to transaction PFCG by making it read only in PRD ?

Regards