restrict update status to Assignee role