Hi Jürgen,
You can achieve this behaviour by adding an action validation to your node. In the validation's node category tab set the 'create' checkbox. Then add the instances which may not be created to the et_failed_key tab in the validations execute method.
Depening on your requirements, you could also implement this by adding an authorization object to your business object..
KR,
Bjorn