Both validation rules and script triggers can be set up to prohibit changes if a "lock" value is set in a field. Manage | security can also do this.
Script triggers prevent changes on a specific layout, thus changes to the data can still be made if the data is accessed from a different layout.
validation rules and record level access controls in Manage security lock things at the data level and thus prevent changes to the data no matter what layout is used.
See "Editing record access privileges" in FileMaker Help and check out this particular sub section: "Entering a formula for limiting access on a record-by-record basis" for a detailed description of how to set up record level access control.
An onObjectEnter Script trigger, on the other hand, can be as simple as:
If [ table::LockField ]
Go to Object ["lock object"]
Where "Lock Object" is a button or dummy field with "Lock object" specified as its object name.