How do you keep your sensitive PO Requisition attachment protected from all staff?

Dear Procurement Guru,

Currently we are on EBS R12.1.3 running GL, AP, AR, FA, CE, PO, XTR, iProcure, iExp, and iSupplier applications. Our business uses Oracle iProcurement application to submit their requisition request for approval and processing. They also attach their related documents, such as software contract, consulting contract, MSA, SOW and other such documents. Some of these documents are sensitive document and it should be visible only to requester, approvers and the Sourcing Department and not the entire organization staff.

We came to know that all our Oracle Financial application users that have Oracle Payable Inquiry or iProcurement responsibility can query anybody’s PO Req, PO and the attachments document to each of Oracle PO Requisition and or Purchase Orders.