correctly spell the role
permission check for workflow actions