The field xpath in the form is to be dynamic.
If you have permissions by group or individuals than just set these in the permissions tab in the DAT configuration.
The document level permisions would be this scenario.
Vacation request form
Use AD webservice to identify the user filling out the form and save their ID in the form.
Put security on that field where the user only has write permissions.
Same employee opens form again they can modify.
Same employee tries to open another form which is not theirs and they cannot since the userID does not match the field.
Workflow can be handled the same way so that the assigned users ID is saved in the form and can be used as a check for permissions.
In that case a user would only have access until it was assigned to someone else potentially. This is the true dynamic functionality which you cannot get anywhere else.