Issue #948: More restrictive permissions for bika_one_state_workflow