No script is necessary.
You can set a sentry preference to make editing the associate field read-only on existing contacts.
https://community.superoffice.com/en/technical/documentation/older-versions/documentation-7/admin/security/userpreference---adding-data-rights/sentry-preference-example/
You need to use the Rest API