I might propose migrating away from VSS due to its inability to grant and deny permissions at the file level. The question is what source control systems allow this.
Update I am marking the SVN answer as the "correct" one, since it had the most feedback. However, there is no correct answer. I will make my recommendations to management based on all your feedback.
I'm not really answering your question, but I think it's not a very useful feature to have permissions on VCS. People should know where they're allowed to commit, people should be reviewing commits, and if someone's committing where they're not supposed to:
If you're worried that people will make unauthorized changes, then you have a social problem that the permissions won't fix. If you're worried that people will accidentally make changes to the wrong code, then you have a different social problem (lack of review) that the permissions also won't fix.