Transition Security
All valid transitions between two states must be specified. If no transition is specified, by default no transition is allowed.
Additionally, you can optionally use the attributes for and not in the transition element of workflow to refine who is and who is not able to perform a transition. When you do this, denies takes precedence over allows. If neither of these attributes are specified, anyone can modify the work item.
Example
In the following rule, the ability to transition a work item from the Resolved to the Completed state is restricted to all project testers, except new testers who have just joined the team.
<TRANSITION from="Resolved" to="Complete" for="[project]\AllTesters" not="[project]\NewTesters">
</TRANSITION>
Note
Multiple groups are supported only by creating a parent group and specifying the parent group in the TRANSITION element.