But you also confirm it when you revoke the access and see who complains (after sufficient warning to get their house in order and get custom transactions built). As an interim, move the SA38 to a firefighter/emergency access setup as temporary access
I constantly lose the battle to restrict SE16/SM30/31/34 and SE38/SE37/SA38/etc from Production systems. It won't stop me from trying and educating functional to get their access requirements in for support users.
Regards
Colleen