only user with the 'change states' permission can change state