I have a site in which content must be approved by an administrator before it is published. Authenticated users have the ability to submit content, which is unpublished by default. I would also like to be able to have them view and edit content while it is in the unpublished state (for cases in which they realize they made a mistake and would like to correct the submission, etc.)
However, I do not want them to be able to edit the content once it is published, so I don't want to give them blanket edit permissions.
How can I allow them to edit nodes of a given content type only so long as such nodes are in an unpublished state?