Consider the following requirement: Car dealers cannot modify orders in the Fulfillment stage.

Access of Role to Object (ARO) is used to define the level of access that a role has to instances of a class. In this case, an ARO can be created for the car dealers' role to restrict modify access to orders in the Fulfillment stage. References: Pega Platform Help - Security.