How to limit user's job authority (only can execute build, not configuration)

I have to lmit user’s job authority.
User can execute build specific job
but limit modifying configuration so user can’t change job configuration.
Is there any possible way to do this?

Matrix Authorization Strategy + don’t give everyone admin