Hi Jesse!

Manage Entry Access is the assigned privilege required to modify any entry's access rights. If the user does not have this assigned privilege, they can still modify access rights for a specific entry if they have the "Write Security" access rights enabled for an entry.

So to prevent users from modifying any access rights, don't give them Manage Entry Access assigned privilege and Write Security access right.