@karlenigma this is what NetSuite told me to do because we wanted a certain role to be able to attach files to vendors, but that role should not be able to edit vendor records:

I. Set the Vendor permission to Edit. 
1. Login as Administrator.
2. Navigate to Setup > Users/Roles > Manage Roles > Edit Our Custom Role.
3. Under Permissions subtab > Lists sublist > Set the Vendor Permission to Edit level. 
4. Click Save. 


II. Create Workflow to Lock Vendor Record from Editing. 
1. Navigate to Customization > Workflow > Workflows > New.
2. Enter the Name of the Workflow.
3. Set the following fields: 
- Record Type = Vendor 
- Execute as Admin = T 
- Enable Logging = T 
- Release Status = Released 
- Event Based = T 
- On Create = T 
- On View or Update = T 
4. Click the Arrow beside the Condition field. 
5. On the Pop-up window, set the following workflow condition:
- Field column = User Role 
- Compare Type column = any of 
- Selection column = Our Custom Role 
6. Click Add and then Save. 
7. Click Save at the bottom. 
8. Click on State 1 and click New Action. 
9. Select Lock Record.
10. Click Save. 

This will lock the Vendor record from edit while it allows the custom role user to be able to attach files on the record.