Only secure masters can read/write the XMPU. It should only be configured once at boot time. Once it is configured at boot time, its configuration is locked. If an XMPU register set is locked, the XMPU can only be reconfigured after the next system reset. If the configuration is not locked, then the XMPU can be reconfigured any number of times by trusted software (using a secure master).
RECOMMENDED: Xilinx recommends only configuring each XMPU one time. If you program an XMPU, program all its settings. This ensures only the programmed transactions will go through.