protect state_id from users who do not have permission to change it - 4F