I'll use a Customer BO as example.
1) create attribute Customer.CreatedBy -- reference to RegularUser
2) Add 2 rules:
If Customer IS NEW Then Customer.CreatedBy=LoggedInRegularUser
If Customer.CreatedBy<>LoggedInRegularUser AND Customer.CreatedBy IS DEFINED Then PROTECT Customer FROM ALL