Issue #948: More restrictive bika_one_state_workflow permissions