As described in Configuration Lock, from the Overview section, the XMPU_PL configuration registers can be write protected from unauthorized masters, but are still readable. The following figure demonstrates one way to completely isolate the configuration I/F.
Map the S_AXI_XMPU configuration slave port to the M_AXI of the
zupl_xmpu instead of using the Configuration Lock. Either the
static or run-time configuration can define a region to protect the XMPU_PL
configuration from both read and write accesses.