I don’t think there’s a way to do this normally, unfortunately. However, something we do is have a folder of config memory tags, for things like priority, set point, etc. and have the alarm properties bound to those. That way, the memory tags are easier to monitor.
I’m guessing he has historian or a transaction group enabled on those memory tags in order to track any changes.
I don’t believe there is a permission or anything that will prevent changes to specifically just alarms. You could make a separate user group though and have that group only have access to add/remove/modify tags through client permissions or through the tag provider settings. I haven’t really used either of these before, so I’m not sure which would be preferred or if there are any further quirks.