I dont want the Key user being able to change the message proccesor

Hello experts, right now my key user in the service desk is able of changing the message processor in the incident managament browser, and I have asssigned it the next roles:

Z_SAP_SMWORK_BASIC

Z_SAP_SMWORK_INCIDENT_MAN

Z_SAP_SUPPDESK_CREATE

Which are the objects that I have to change for restrict this?

Thanks,

Paul