How to lock a node from a certain role after changing state in workflow?
For this you should have to implement hook_node_grants and hook_node_access_records. It look something like that -

 /**
  * Implement @hook_node_grants 
  */
 function MODULENAME_node_grants($account, $op) {

  $grants =array();
  $grants['Node_Edit_Permission_Content'][]=array($account-&gt;uid);
  $grants['Node_Edit_Permission_OtherRole'][]=array($account-&gt;uid);
 return $grants;
}

/**
 * Implement @hook_node_access_records
 */
function MODULENAME_node_access_records($node) {

  $grants = array();

  if ($node-&gt;type == 'node_type') { 
    $user_id_content = /* list of user id which you want to block */;

     // Revoke Permissions from these Users
    if (!empty($user_id_content ) {
      foreach ($user_id_content as $uid) {
        if (isset($uid)) {

          $grants[] = array(
            'realm' =&gt; 'Node_Edit_Permission_Content',
            'gid' =&gt; $uid,
            'grant_view' =&gt; 1,
            'grant_update' =&gt; 0,
            'grant_delete' =&gt; 0,
            'priority' =&gt; 0,
          );
        }
      }
    }

    $user_id_other_role = /* list of user id which you want to block */;

     // Grant Permissions from these Users
    if (!empty($user_id_other_role ) {
      foreach ($user_id_other_role as $uid) {
        if (isset($uid)) {

          $grants[] = array(
            'realm' =&gt; 'Node_Edit_Permission_OtherRole',
            'gid' =&gt; $uid,
            'grant_view' =&gt; 1,
            'grant_update' =&gt; 1,
            'grant_delete' =&gt; 0,
            'priority' =&gt; 0,
          );
        }
      }
    }
  }

  return $grants;
}