Under Linux I can:
chattr +i SOMEFILE
so that even root can't modify the SOMEFILE. Are there any similar solutions for AIX?
At first I thought that ACLs could do the job. But a quick google revealed that the owner and root can (re)set ACLs on AIX.
A workaround might be using an NFSv4-mount from another server. In that environment root normally is mapped to a different (not privileged) UID.