a client has requested that they want a user to be able to create credit memos and customer payments, but not apply them (they want to restrict application to a different role as a segregation of duties thing). it doesn't seem possible with standard permissions, but curious if anyone else has run into this request before or has any ideas? i was thinking about trying to hide the "apply" sublist (via form, WF, or script) for that role, or maybe the only way is returning an error via script if they try to apply it or something. but hoping for a non-scripted option if possible.

Scripting is gonna have to be your poison here - and it's gonna be complicated as all get out

What if instead of Customer Payment those users could do Customer Deposit. One of the advantages of NetSuite though is automations and allowing more entry up front. Maybe the other roles could have an “approve” function instead of trying to block native functionality.