diff --git a/entity/Offer_entity/grantUpdateProcess.js b/entity/Offer_entity/grantUpdateProcess.js
index f022059101691315bf584048dfcd766f0d747cdf..dd8ad2ced390f8db78ba4b8eb638915cfdda25aa 100644
--- a/entity/Offer_entity/grantUpdateProcess.js
+++ b/entity/Offer_entity/grantUpdateProcess.js
@@ -1,2 +1,14 @@
+import("system.tools");
+import("system.result");
+import("system.vars");
+import("KeywordRegistry_basic");
+
 // as one field (status) should be editable if status is sent and all other not, it is done by a state process in each field.
-// using the grant update would also disable the status field.
\ No newline at end of file
+// using the grant update would also disable the status field.
+
+var status = vars.get("$field.STATUS");
+var editable = status != $KeywordRegistry.offerStatus$sent()
+    && status != $KeywordRegistry.offerStatus$won()
+    && status != $KeywordRegistry.offerStatus$lost();
+
+result.string(editable || tools.hasRole(vars.get("$sys.user"), "INTERNAL_ADMINISTRATOR"));
diff --git a/entity/Order_entity/Order_entity.aod b/entity/Order_entity/Order_entity.aod
index ea20792d664c1f6d3213eaeb1ef3dc411bfc94c2..090bc46b1ac2b2383882f5ccdd94f06126ba58f1 100644
--- a/entity/Order_entity/Order_entity.aod
+++ b/entity/Order_entity/Order_entity.aod
@@ -4,6 +4,7 @@
   <title>Receipt</title>
   <majorModelMode>DISTRIBUTED</majorModelMode>
   <documentation>%aditoprj%/entity/Order_entity/documentation.adoc</documentation>
+  <grantUpdateProcess>%aditoprj%/entity/Order_entity/grantUpdateProcess.js</grantUpdateProcess>
   <grantDeleteProcess>%aditoprj%/entity/Order_entity/grantDeleteProcess.js</grantDeleteProcess>
   <contentTitleProcess>%aditoprj%/entity/Order_entity/contentTitleProcess.js</contentTitleProcess>
   <contentDescriptionProcess>%aditoprj%/entity/Order_entity/contentDescriptionProcess.js</contentDescriptionProcess>
diff --git a/entity/Order_entity/grantUpdateProcess.js b/entity/Order_entity/grantUpdateProcess.js
new file mode 100644
index 0000000000000000000000000000000000000000..1559507308ff05db1a670d59cd825ca8d9d24160
--- /dev/null
+++ b/entity/Order_entity/grantUpdateProcess.js
@@ -0,0 +1,6 @@
+import("system.tools");
+import("system.result");
+import("system.vars");
+
+var editable = !parseInt(vars.get("$field.ORDERSTATUS"));
+result.string(editable || tools.hasRole(vars.get("$sys.user"), "INTERNAL_ADMINISTRATOR"));