Is DFU capability a part of the *ALLOBJ privlidge or can DFU be separately denied?

Joe,
 
You provided the thoroughness of answer I was looking for.   I, of
course, know what *ALLOBJ does but I've got a "political" situation
wherein I'd like to restrict DFU from someone that has WAY too much
authority (*ALLOBJ).   
 
Being a person that cut their teeth on RACF, TOP SECRET, etc., in the
mainframe environment where security is taken SERIOUSLY, I'm well aware
too many people have WAY TOO MUCH authority, especially *ALLOBJ,
*SPLCTL, etc.   But until I can get management to take securing the
organization and customer data seriously and really limit special
privileges to only those that really need it,  I'll have to find ways to
"limit" actions, one command at a time... and, of course, take the
command line away.
 
Thanks again,
 
Dave