Different Security for BSO/ASO plan type

Summary

How to set up different security for ASO & BSO plan types

Content

I'm aware that in EPBCS the security cannot be set up at the Plan Type level.  We have a situation where on the BSO side our users need to be able to write to any Entity while on the ASO side they can only see certain roll ups.  Is there an easy way to accomplish this?  I thought there was an Enhancement on the queue to help with situations like this but I cannot find any details on the pending enhancements.

Any suggestions will be greatly appreciated.