In the workflow details page, there seem to be no permission checks. For
example, a user with Author role can finish all tasks, and publish an item.
Fixed in perforce 32809. Also, as of this change, all the tabs of the section
UI, with the exception of the roles tab, have been audited for visibility and
form submission security checks.
Still no permissions @33049/Oracle.
Log in as a user in Authoring role.
Can finish authoring task (of course).
Can then finish the Approval & Deployment tasks & publish the article.
Perforce 33333 (what a pleasing change number) prevents users without the
SCHEDULE_PUBLICATION privilege from submitting the apply lifecycle form. More
work on this ticket to come.
Fixed with perforce changes 33368 and 33377.