Protect state_id from users who do not permission to change it