LTM and APM access

i have both LTM and APM running in my BIG-IP. Is there a way to give read-write access to a user only to APM functionalities and have only read-only access to LTM functionalities? I know configuring a AAA policy under APM and then tie'ing it to a Virtual Server under LTM are needed even for a basis authentication configuration. But still want to understand if there is a possible access restriction we can do in BIG-IP, if there is a user who only needs to have read-write access to change stuff under APM alone???