How to implement typical security rule to user group?

[Kr.Kristen]

I am implementing security rules in openERP for CRM.

Now I want to restrict user group to update certain values.

Now sale person can qualify opportunity but can not "mark won"

Sales manager only can do "mark won".

How can I implement this in openerp? Does this possible !!! OpenERP 7.0 Stable