A challenge is if you want to lock down certain fields on a built in record. For example I want to give sales reps / customer service edit permission on customer records, but not allow them to change financial fields like credit limit. I am currently using a workflow to lock the fields but it wont prevent them scripting etc... I suppose the real solution is to remove edit access to the field, and create a suitelet with "Run as Role" permissions that allows them to change the fields they should have access to.