Control who can add ad-hoc items to work order

Summary:

We have certain operators that we don't want to be able to add items to a work order or increase the quantity of the component above what is on the item structure or work definition.

Content (required):

We know how to control the ability to add components not in or increase the quantity above the item structure. We need the same ability in the work orders. Does anybody know how to do this?

Version (include the version you are using, if applicable):

Code Snippet (add any code snippets that support your topic, if applicable):