If you want to achieve this by user exit then probably other forum will be more suitable than security. If you want to stick to standard tools like authorization objects delivered by SAP then check out SU24 for your transaction or run authorization trace (ST01) to see if there is any authorization objects that you could use to achieve your requirement.
Cheers