Making the Root Item Class Public

Summary:

For all new implementations, the Root Item Class is public, and the flag is not updateable.

If the customer has product management access through SCM modules (without the Product Hub License), then I don't think they are supposed to be creating new item classes.

I'm trying to figure out how I can implement Item security.

Content (required):

As explained above, if the license only allows the Root Item Class, and the Root Item Class is public, how can I implement the solution, so that users with roles like Inventory Manager, Cost Accountant won't be able to update the items through the deep links they have in their respective user interfaces.