Protect state_id changes from users who don't have permission