How can I prevent users from modifying attributes of released items?

Although our permissions are set up to prevent users from changing (most) attributes on released items, they can put an item on a CO and modify its attributes. The attribute change 'sticks' (even if the CO is subsequently deleted).

I know there are Agile limitations regarding the support of versioned attributes (which are slowly being addressed), but is there any way (through roles & privileges) to prevent users from modifying these attributes of Released items?

I do want them to be able to modify attributes while the item is at preliminary, but only via a formal change process once it's released.