Permission to edit orders, but not delete
Here's the proper way to do it with

hook_commerce_entity_access


  Allows modules to deny or provide access for a user to perform a
  non-view operation on an entity before any other access check occurs.
  
  Modules implementing this hook can return FALSE to provide a blanket
  prevention for the user to perform the requested operation on the
  specified entity. If no modules implementing this hook return FALSE
  but at least one returns TRUE, then the operation will be allowed,
  even for a user without role based permission to perform the
  operation.
  
  If no modules return FALSE but none return TRUE either, normal
  permission based checking will apply.


Example

/**
 * Implements hook_commerce_entity_access
 */
function MODULE_commerce_entity_access($op, $entity, $account, $entity_type) {
  if ($entity_type == 'commerce_order' &amp;&amp; $op == 'delete') {
    // Require administer orders permission to delete orders
    if (!user_access('administer commerce_order entities', $account)) {
      return FALSE;
    }
  }
}