AP Posting Security

we are currently running 9.05.607 and are curious if anyone has done user security for sub modules(AP, AR etc..) to limit posting ability by user. I have been told you cannot do this through epicor security but it appears a BPM should be able to handle this.