SAP SECURITY INTERVIEW - User have tcode SA38. How to restrict user to execute only report rsusr003.

Use SE93 to create customize tcode:  a) via 'transaction with value' where we use SA38 screen as inheritance. We have option to hide SA38 screen to avoid user running other program. b) via 'transaction with value' where we use START_REPORT to call program it self.  Or you can change the following object in the role  with tcode SE38 and in authorization object S_DEVELOP the  activities DEVCLASS '*'            OBTYPE '*'            OBNAME  ' RSUSR003'            p_group '*'            activity '03'