Two-step process: timesheets have to be validated by superiors before they can be processed.
Generate the users' timesheet automatically based on the appointments in the planning.
Regular users can only see their own timesheet. Users with the required user rights can view, confirm and create timesheets for other users.