only users with permission can change states