The quick answer
Open your sales order approval workflow under Customization > Workflow > Workflows, select the state the order enters once it's approved, and add a Lock Record action with New Action. It runs on Before Record Load, so every order in that state opens without an Edit button. With no condition it locks everyone, administrators included, so give the action the condition User Role none of Administrator (shown as User Role != Administrator) to keep the Administrator role able to edit.
The screenshots show sample data. Person and company names are fictional. Use your own workflow, roles, and orders when following the steps.
Before you start
This example uses Alder Ridge Outfitters, which approves sales orders with a released workflow called Sales Order Approval. It has two states. Pending Approval is the start state and adds an Approve button. Approved has an entry action that sets Order Status to Pending Fulfillment, and it has Do Not Exit Workflow checked, so the order stays in that state after approval.
That last part is what makes the lock stick. An action only runs while the record's workflow instance is in its state. Put the lock on the state the order sits in after approval, and give that state no transition out, so the instance stays there. Do Not Exit Workflow keeps the instance active instead of ending it when there's nowhere left to go.
You need the SuiteFlow feature and a role with permission to edit workflows; the Administrator role has both. The workflow here is a Transaction workflow for Sales Order that initiates on create and on view or update. It has to be Released for the lock to affect other users. In Testing it only runs for the workflow owner. The Approve button is itself an Add Button action, and in your own account it should normally have a condition that limits it to approvers.
01. See that an approved order can still be edited
As Administrator, open SO4816 for Westfield Trail Co. It's Pending Approval, and the workflow adds an Approve button next to Edit.
Click Approve. The order reloads as Pending Fulfillment, the status this workflow's Approved state sets. Edit is still there, so anyone who can open the order can still change the lines and prices you just approved.
02. Open the Approved state
Go to Customization > Workflow > Workflows and click Sales Order Approval.
The workflow designer shows Pending Approval, marked START, leading to Approved. Click the Approved state. The State panel on the right lists one action, under State Event > Entry: Set Field Value, Order Status=Pending Fulfillment. Nothing runs when the record loads yet.
03. Add a Lock Record action
At the bottom of the State panel, click New Action, then choose Lock Record from the list of action types.
The Workflow Action form opens with State Approved, Type Lock Record, and Trigger On Before Record Load. Leave the Condition empty for now and click Save.
The State panel now lists Lock Record under Record Load > Before Record Load.
04. Reopen the order
Open SO4816 again in a fresh page, for example from Recent Records. It's still Pending Fulfillment, and Edit is gone, even though you're logged in as Administrator. A Lock Record action with no condition locks the record for every role.
The lock reached an order that was approved before the action existed. Before Record Load actions run every time the record opens, so any order whose workflow instance is still active in the Approved state is locked the next time someone opens it. An order whose workflow already ended isn't affected.
05. Exclude administrators
Open Sales Order Approval again, select the Approved state, and click Lock Record in the State panel. Its Condition box is empty, which is why it locks every role.
Next to Condition, click the open icon to open the Workflow Condition window. In Field, type User Role and press Tab. Compare Type changes to any of; choose none of. Value is disabled for this field, so type Administrator in Selection, press Tab, and click Add. The row reads User Role, none of, Administrator.
Click Save in the condition window. The action's Condition box now reads User Role != Administrator, meaning "lock for every role that isn't Administrator." Click Save on the action.
To spare more roles, such as an order management role, add them to the same Selection.
06. Check both roles
Open SO4816 again. You're using the Administrator role, so the condition is false, the lock doesn't run, and Edit is back.
Now point to the account name at the top right and choose Sales Manager to switch roles. For this test to mean anything, Sales Manager must be able to edit sales orders when there's no lock; otherwise a missing Edit button proves nothing.
Open SO4816 one more time.
Check the result
- As Administrator, SO4816 shows Edit.
- As Sales Manager, the same order is Pending Fulfillment with no Edit button.
- The Lock Record action on Approved shows Trigger On Before Record Load and Condition User Role != Administrator.
The condition checks the role the user is logged in with, not every role the person holds. Someone who also has the Administrator role is still locked out while using Sales Manager. Checking Execute As Admin on the workflow doesn't change that. It only changes the permissions the workflow's own actions run with, not the role a User Role condition sees.
Lock Record controls the record form. It isn't a full security control. A list can still show an Edit link, and Before Record Load doesn't run for inline editing, so the lock doesn't stop Direct List Edit. Don't rely on it for CSV imports either, and test your integrations and scripts in your own account. If those channels matter, add a Return User Error action on Before Record Submit with event types that cover them, such as Direct List Edit, with the same role condition. A script or a permission change works too.
Common questions
Why did the Edit button disappear from my sales order?
A Lock Record action is probably running on the workflow state the order is in. It runs Before Record Load and opens the order read only. With no condition it applies to every role, Administrator included, so check the action's Condition first.
Does Lock Record affect orders that were already approved?
Yes, as long as their workflow instance is still active in the locked state. The action runs every time the order loads, so orders that reached Approved before you added the lock are locked the next time someone opens them. Orders whose workflow already ended aren't affected.
Does a locked record stop CSV imports or inline editing?
No. Lock Record controls the record form, and Before Record Load doesn't run for Direct List Edit, so inline editing still works. Don't rely on it for CSV imports either. Add a Return User Error action on Before Record Submit, a script, or a permission change for those channels.
Why can't I edit even though I have the Administrator role?
The condition checks the role you're logged in with, not every role assigned to you. If you're using Sales Manager, you're locked out like any other Sales Manager. Switch to the Administrator role. Execute As Admin on the workflow doesn't change the role the condition sees.
How do I let more roles edit a locked order?
Open the Lock Record action, open its condition, and add each role to the Selection on the User Role none of row. Anyone using one of those roles gets Edit back the next time they open the order. Test each role you added.
How do I unlock a single order?
An administrator can cancel the order's active workflow instance from the workflow information on the order. That ends the workflow for that order, so the lock stops running, but it also skips whatever the workflow would have done next. Keep it for real exceptions.