Are you using CME ?
You can configure either COR (Class Of Restrictions) or PIN/Login. Search for that on CCO.
COR is static, and can be integrated with another technique, special prefixes, for override. PIN/Login requires a per-phone PIN to unlock certain forbidden (permanently or within certain hours) user-definable patters.