There is an as-base-jobtype resource class in EEM.
See the CA Workload Automation Security Guide for more information.
Here is an excerpt:
The as-base-jobtype resource class controls whether you can insert, update, override, or delete jobs belonging to predefined CA Workload Automation AE job types like Box (BOX), Command (CMD), Database Monitor (DBMON), and so on. The as-base-jobtype resource class differs from the as-jobtype resource class, which is used to control access to user-defined job types. The base job type resource class has only EXECUTE access mode while the user-defined job type resource class has all access modes.