What's the normal way in Alfresco for document approving process? From my understanding, (1) if a document is submitted for approving, it and its meta data shall not be editable. unless it has been rejected. (2) if a document is submitted for reviewing, the people in the process can edit the document.
I don't know if I am right. For Case (1), how could it be implemented?
Out-of-the-box no permissions are altered as part of the approve or review workflows. The menu items in the workflow task may not make it easy for the person managing the workflow task to edit the document or the document's properties, but if someone with access were to navigate to the document via the folder structure, they could make changes even if the document is in a workflow.
If you would like to modify the out-of-the-box workflows (or better yet, create your own custom workflow using those as a starting point) you can, and as part of the workflow you could alter the ACL to set it as you wish.