Authorisation for OKP1 to differentiate between plan and actual

Hi there...

I have a requirement to separate the opening of CO plan periods from actual periods, ie, this will be managed by 2 different teams. I've checked the auth object for TCode OKP1 and seems like the auth object S_TABU_DIS only has 1 table type (KC) for this transaction. I don't seem to be able to control it by whether it's for plan version or actual.

Is there any other way I can do this besides using custom auth objects and ABAP?

Any suggestions?

Thanks.