Unable to restrict extract submission by security profile

Summary:

We have a requirement that someone logging in with a service account should be only running one particular extract and should not be able to submit all the extracts.
With the current set up user can run every extract. The profile does not restrict.

Can you please help us restrict the service account to run only above-mentioned extract.

Roles assigned to the service account: The service account has only one job role (see attachment for more details).

ARE EPM Integration Job Role- Custom Job Role

Created below data role and added the security profile to it(see attachment for more details).