customer & prospect master changes?

Hi Experts,

I have an issue, my user has authorisation of Tcode XD01, XD02, & XD03 (create, change, display) customer master.

using same codes, prospect master created & quotations created using prospect master, but this user can create/change customer master also. i wanted to restrict, creation, change, display for customer master. how i can restrict, what is the authorisation object so that this user cannot create customer master.

i have different number ranges & account groups for customer master & prospect masters, but i am not able to restrict, bcos tcodes.

pl help and suggesting solution

thanks in advance

srihari