Most of the Tridion GUI probably bases the parameters that it represents on the so-called Allowed Actions. This is a combination of the Allow and Deny attributes that are present in list calls (if required) and the XML element.
So, at least you will need to remove the CheckIn and Edit action from the Allow attribute (and maybe add them to the Deny attribute). If you look at the Core Service documentation (or any other Tridion API documentation: these values ββhave not changed for a long time), you can find an Enum called Actions that contains possible actions and their corresponding values. The Allow and Deny attributes are simply the addition of these numbers.
In the CheckIn action, I mention number 2 , Edit is 2048 .
Update :
I have a small command line program to decode AllowedActions for me. To celebrate your question, I quickly converted it to a web page where you can find it here . Below is the main workhorse and shows how you can decode the number and how it can be manipulated. In this case, this is all subtraction, but you can just as easily add the allowed action by adding a number to it.
var AllowedActionsEnum = { AbortAction: 134217728, ExecuteAction: 67108864, FinishProcessAction: 33554432, RestartActivityAction: 16777216, FinishActivityAction: 8388608, StartActivityAction: 4194304, BlueprintManagedAction: 2097152, WorkflowManagedAction: 1048576, PermissionManagedAction: 524288, EnableAction: 131072, CopyAction: 65536, CutAction: 32768, DeleteAction: 16384, ViewAction: 8192, EditAction: 2048, SearchAction: 1024, RePublishAction: 512, UnPublishAction: 256, PublishAction: 128, UnLocalizeAction: 64, LocalizeAction: 32, RollbackAction: 16, HistoryListAction: 8, UndoCheckOutAction: 4, CheckInAction: 2, CheckOutAction: 1 }; function decode() { var original = left = parseInt(prompt('Specify Allow/Deny actions')); var msg = ""; for (var action in AllowedActionsEnum) { if (left >= AllowedActionsEnum[action]) { msg += '\n' + action + ' ('+AllowedActionsEnum[action]+')'; left -= AllowedActionsEnum[action]; } } alert(original+msg); }