Permissions: how to let users create revisions but not publish them?

I have come a bit unstuck trying to make my website editor's dreams of maximum control for minimum effort come true!

As far as I can tell, the "edit" permissions allow a user to edit the specified nodes whether the node is published or not, so that a user who is not allowed to publish nodes can still make live changes to nodes once they have been published. Have I understood this correctly?

The problem is our website editor doesn't want anybody to be able to make changes to the site without his approval. At the same time, he doesn't want to have to actually do all the editing himself!

Is there any way to set up permissions to allow certain roles to create revisions to published nodes but not to publish those revisions? I.e. the published version of the node will remain the same until the website editor approves the changes entered by the user?

If that's not possible, is there any way to allow a user to edit unpublished nodes but not published ones? I would at least like people to be able to draft and edit their content before it gets to the publishing stage, even if it has to be in the hands of the editor after that.

I would be extremely very grateful for any suggestions or links - I have searched and searched but this time I have to give up and put myself at the mercy of the forums :-)

Many many thanks in advance to anyone who can help,

Cat