Generally you would need a workflow and to check some property on the PO/Expense via the employee on the PO, and restrict/allow based upon that