Protect state_id form users who do not have permission to change it