about security rules

[listy]

You can add trigger (js), which will be fired when status change is made, and check the user who made a change doesn't allowed, and reject transaction.