VA02 User exit - authorization (AND same requirement for IW32)

I require user exits in VA02 and IW32 that allows me to stop some users profile from changing Sales Orders and Service Orders.

Our idea is to create an Autorization object and asign it to a user profile.

When users try to Modify a Sales order or a Service Order, system should verify authorization object first. If not then user cannot access to the document.

User exits should be available when document is going to be open, not after opening (meaning that user exits where saving do not work either).

Thanks for your help