Restrict editing of a custom post type based on status and user capabilities

There’s another great article here. They walk you through the 4-step process that they used to set it up.