Workflow does not work correctly
Edit your Workflow again (after you created the states) and scroll down to the bottom to 'Access control' section. In there you can set permissions for each state.

You can also look at the Workflow Fields module if you want to set access to individual CCK fields.