You should be able to create a security rule which restricts write access when the status is done. Something like this. If you have a group you wish to specify then select it. If you have no group I am not sure however you may be able to either leave this field out or place an empty array to represent all groups.
<record id="no_edit_when_done" model="ir.rule">
<field name="name">No Edit When Done</field>
<field name="model_id" ref="model_youraddon_yourmodel"/>
<field name="groups" eval="[(4, ref('base.group_user'))]"/>
<field name="perm_read" eval="1"/>
<field name="perm_write" eval="0"/>
<field name="perm_create" eval="0"/>
<field name="perm_unlink" eval="0"/>
<field name="domain_force">
[('status','=','done')]
</field>
</record>