Hi - is it possible to give people file attaching rights without giving editing rights on transactions?

Use workflows to return user errors if they try to create or edit things?