protect state_id from users who do not have permission to change it, 17 F