In RTC, every user gets one or more roles assigned. You can set permissions to change states and attributes for every role. See https://jazz.net/library/article/291 for how that works.

I assume that the CR work item type has separate Contributor attributes for Owner vs Verifier. If so, then assuming that everyone in the cross-functional team has both "owner" and "verifier" roles (so that they have the proper permissions to do things when they are performing the duties of both at any time), then I believe this would have to be done via a java custom Validator.  For the CR work item that is in Verification state, you would check the person making the change (current user) against the Contributor in the 'verifier' attribute and if they are not the same (and it isn't a comment being added), then you could give an error (or perhaps just certain attributes that you only want the Verifier to be able to change).  You would want to check if the prior state is Verification and it is transitioning into the next state, that the current user is the Verifier and if not, throw an error.

If you want a state based operational behavior, you have to extend RTC. See https://rsjazz.wordpress.com/2014/05/26/only-owner-can-close-workitem-advisor/ for an example.