We have a simple requirement that after the item is created and submitted for Approval, the item should be made readonly for the creator, and after the Approver approves the items it would remain that way however if Approver needs changes the create should be able to change the item. So based on who the Item is assigned to only the assignee person/group should be able to change it and rest of the people should be able to view it. 

Does Nintext has any best practice or guide line for this ?

Also Considering that in rare situation when the workflow goes into error , admin should be able to move the workflow back one stage or restart without needing to fiddle with item permission?