Shane,
There are a number of ways you could do this. Think the easiest would be to deny a role the ability to execute the action (delete invoice). Then you could assign the users a role that doesn't have permission to execute that role.
Another way could be to hide the button. Much like the first example, you can edit the button itself, and hide it for certain roels. This would be good if the button only has one action set to execute, thus hiding the ability for the user to click the button. You could also use a password field. An example would be to create a textbox and a button with a conditional statement to validate the text in the field before executing (eg. validate your password).
Hope this helps.
- Adam