Locking a Record So Changes Can't Be Made

Locking a Record So Changes Can't Be Made

Is there a way using criteria to prevent users or groups of users from changing a record? For example, if an invoice status is PAID, don't allow anyone to edit it any more.