The security needed to create a PO is embedded in the duty named 'Maintain purchase orders'. There is no ability to separate this security so someone is allowed to maintain a PO but not create it. (i.e., Users outside the SCM team should not be able to create a PO, but they should be able to maintain it.)