Hi.
You (the database administrator) can decide which privileges each user has.
A user must have the CREATE_ROUTINE privilege to create procedures and the ALTER_ROUTINE privilege to be able to change a procedure.
However, the EXECUTE privilege is all that is required to call a procedure.
So, a user without the first two but with the third would only be able to execute procedures but not alter them.
To grant and revoke privileges, see:
12.5.1.3. GRANT Syntax and
12.5.1.5. REVOKE Syntax.