Authorizing a principal to use certain services

[Diego González <dggonz@gmail.com>]

is it possible to authorize a principal or set of principals to access
a given service?

i mean, can i do something like saying:

diego@LDH.ES can acess imap/ganimedes.ldh.es and smtp/ganimedes.ldh.es
but not ldap/helios.ldh.es?

Thanks