Hi,

My understanding to your use case is that you would like to keep someone from modify specified assets. I think authorization to modify asset state is part of the capability of "update assets" role permission. You can keep someone from modifying asset in one community by setting his or her permission with "update assets" unchecked.

If what you need is just keep him or her from changing one specified asset's lifecycle, I think you can implement that by modifying the transaction of lifecycle state, like adding condition that state transaction need to be approved by other approver.

Thanks