How to restrict time and labor manager to edit approved timecard

Summary:

We have a requirement to have custom time and labor manager roles.

One role user should not have access to edit approved timecard.

but other custom time and labor role user (very few users) should have superior access to edit all timecards.

How to setup this requirement.

Content (please ensure you mask any confidential information):

Version (include the version you are using, if applicable):

25C

Code Snippet (add any code snippets that support your topic, if applicable):