Actually in order to keep tracing about posted document tables modification we use report/codeunit with related permission. For minor data correction I made an "utility" page with serveral lists linked based on Sales Invoice Header, Sales Invoice Line, etc... each one with the specific permission.
Unfortunately having a specific servicetier for this purpose it's a really unpractical solution and doesn't work for us since sometimes we need immediate data changes.