Security in Web Dynpro screens

I have a generic web dynpro screen which allows users to create / edit some records. The users are supposed to create records only for the profit centers that they are authorized to.

1. I have a profit center lookup in the screen that I created that pulls up profit center in pop up screen. How do I filter profit centers only that the user belongs to.

Do i have to manually write code to restrict based on user roles.

2. Also how do I restrict the users from saving the records for the profit centers to which they are not authorized.

FYI -- I used single system user to get and write data to SAP backend system.

I am new and trying to understand security at the screen level...

Thanks