How-to prevent users from changing the ownership or the permissions on a posix filesystem

My question might look silly because I'm coming from a Windows / NTFS background. We have a linux filesystem shared across several people. The tree looks like this:

- /data
  |- shared
     |- Alice
     |- Bob

We have set up the permissions on the shared folder with the following permissions drwxrwsr-x and ownership as head_of_department:department. We noticed that, over time, the permissions got changed. Unfortunately, I cannot seem to find resources on this specific topic on the web. Is there a way we can _lock_ the permissions to the ones we want? Or should we have some cron job that resets the permissions periodically?