How do I control which users are permitted to edit existing orders?

You can use the Create a User/Group Actions – Sales Security setting called Delete/Edit information on open transactions to control access to existing orders. If the box is checked, the user/user group can access existing sales, service, and transfer orders and edit or delete the information on the orders.