only users with the 'change states' permission can change states