But, if you control the other routers, you can restrict the permissions. I think upgrade is a "policy" right so if you assign the admins to a group without that permission, that might work too. See: https://wiki.mikrotik.com/wiki/Manual:Router_AAATalk with the other administrators and both agree on what version to upgrade your routers...