@joe: any Standard Operating Procedure for this in FA?
A really "kludgy" workaround is to duplicate the company stanza in config_db.inc file and put in a different user / password with restricted credentials! Alternatively, hack the save() function for the cart and/or tweak the insert statements for adding in a where clause to see if the session current_user is either admin or matches the record owner.
Otherwise, post your bounty in the Job Offers board with a clear description of what you want.