You can manage all of the actions a user can perform on an object by setting up permissions to be managed by the workflow under the permissions tab. Here, you can select which permissions should be state-dependent from a list of all available permissions, and you can delete previously selected permissions. In each state, use it's permissions tab to set up the role to permission mappings appropriate for that state.