prevent publish

function remove_author_publish_posts(){

    // $wp_roles is an instance of WP_Roles.
    global $wp_roles;
    $wp_roles->remove_cap( 'author', 'publish_posts' );
}

add_action( 'init', 'remove_author_publish_posts' );