You could do this a couple of different ways, but the easiest path would be to create an Allow Object Deletion automation script IBM Maximo Autoscripting Guide – Object launch point
A simple script is below that would throw an error if the user is not in the MAXADMIN group and you're trying to delete an attachment in the WOTRACK application. You would want to define this error in the Database Configuration application and can adjust the criteria as necessary.
if mbo.getThisMboSet().getParentApp()=="WOTRACK":
# Check to ensure user is in the desired security group
groupUserSet=service.getMboSet("GROUPUSER",mbo.getUserInfo())
groupUserSet.setWhere("groupname='MAXADMIN' and userid=:USER")
if groupUserSet.notExist():
service.error("nvm","noDeleteDoclinks")
------------------------------
Steven Shull
Naviam
------------------------------