ext_localconf.php

// Edit restriction
$GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_tcemain.php']['processDatamapClass'][$packageKey] = 'Visol\Userunilupublications\Hooks\Tcemain';
$GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_tcemain.php']['processCmdmapClass'][$packageKey] = 'Visol\Userunilupublications\Hooks\Tcemain';

Tcemain.php

<?php
namespace Visol\Userunilupublications\Hooks;
use Visol\Userunilupublications\Service\AccessControlService;

/***************************************************************
 *  Copyright notice
 *  (c) 2014 Lorenz Ulrich <lorenz.ulrich@visol.ch>
 *  All rights reserved
 *  This script is part of the TYPO3 project. The TYPO3 project is
 *  free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *  The GNU General Public License can be found at
 *  http://www.gnu.org/copyleft/gpl.html.
 *  This script is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *  This copyright notice MUST APPEAR in all copies of the script!
 ***************************************************************/

class Tcemain {

	/**
	 * Prevent saving of a record if the user doesn't have proper permissions
	 *
	 * @param array $fieldArray
	 * @param string $table
	 * @param int $id
	 * @param $parentObject \TYPO3\CMS\Core\DataHandling\DataHandler
	 */
	public function processDatamap_preProcessFieldArray(&$fieldArray, $table, $id, $parentObject) {
		if ($table === 'tx_userunilupublications_domain_model_publication') {
			if (is_int($id) && !$GLOBALS['BE_USER']->isAdmin() && !AccessControlService::userIsPublicationsAdministrator()) {
				$record = \TYPO3\CMS\Backend\Utility\BackendUtility::getRecord($table, $id);
				if (!AccessControlService::userHasGroupPermissionForPublication($record)) {
					$parentObject->log($table, $id, 2, 0, 1, "processDatamap: Attempt to modify a record from table '%s' without permission.", 1, array($table));
					// unset fieldArray to prevent saving of the record
					$fieldArray = array();
				}
			}

		}

		if ($table === 'tx_userunilupublications_domain_model_author') {
			if (is_int($id) && !$GLOBALS['BE_USER']->isAdmin() && !AccessControlService::userIsPublicationsAdministrator()) {
				$record = \TYPO3\CMS\Backend\Utility\BackendUtility::getRecord($table, $id);
				if (!AccessControlService::userHasGroupPermissionForAuthor($record)) {
					$parentObject->log($table, $id, 2, 0, 1, "processDatamap: Attempt to modify a record from table '%s' without permission.", 1, array($table));
					// unset fieldArray to prevent saving of the record
					$fieldArray = array();
				}
			}
		}
	}

	/**
	 * Prevent deleting/moving of a record if the user doesn't have proper permissions
	 *
	 * @param string $command
	 * @param string $table
	 * @param int $id
	 * @param string $value
	 * @param $parentObject \TYPO3\CMS\Core\DataHandling\DataHandler
	 */
	public function processCmdmap_preProcess($command, &$table, $id, $value, $parentObject) {
		if ($table === 'tx_userunilupublications_domain_model_publication' && !$GLOBALS['BE_USER']->isAdmin() && !AccessControlService::userIsPublicationsAdministrator() && is_integer($id)) {
			$newsRecord = \TYPO3\CMS\Backend\Utility\BackendUtility::getRecord($table, $id);
			if (!AccessControlService::userHasGroupPermissionForPublication($newsRecord)) {
				$parentObject->log($table, $id, 2, 0, 1, "processCmdmap: Attempt to " . $command . " a record from table '%s' without permission.", 1, array($table));
				$error = TRUE;
				// unset table to prevent saving
				$table = '';
			}
		}

		// deleting and moving of records is admin and publication admin only
		if ($table === 'tx_userunilupublications_domain_model_author' && !$GLOBALS['BE_USER']->isAdmin() && !AccessControlService::userIsPublicationsAdministrator() && is_integer($id)) {
			$parentObject->log($table, $id, 2, 0, 1, "processCmdmap: Attempt to " . $command . " a record from table '%s' without permission.", 1, array($table));
			$error = TRUE;
			// unset table to prevent saving
			$table = '';
		}

	}

}