How about validity dates on the roles? That way same user is "locked" from processing orders in a plant but can still do accounting if he / she performs two jobs with the same user ID.
Or use the standard options to open / close periods for posting types. That way they are authorized but system does not allow it.
Or... even better... just tell them not to do it and monitor that it they do not co-operate then they don't get a bonus. That works very well!
Cheers,
Julius