Restricting State Transitions
All valid transitions between two states must be specified. If no transition is specified, then by default no transition is allowed.
Additionally, you can optionally use the attributes for and not in the transition element of workflow to refine who is and who is not able to perform a transition. When you do this, denies takes precedence over allows. If neither of these attributes is specified, anyone can modify the work item.
Example
In the following rule, the ability to transition a work item from the Resolved to the Completed state is restricted to all project testers, except for new testers who have just joined the team.
<TRANSITION from="Resolved" to="Complete" for="[project]\AllTesters" not="[project]\NewTesters">
</TRANSITION>
Note
Multiple groups are supported only by creating a parent group and specifying that parent group in the TRANSITION element.