Today we encountered new issue. I am summarizing it below to see if we are missing on anything and it would be good if you can help us find out the problem.

According to the standard steps, we are trying to restrict the trigger to the workflow action for certain role and for certain states. Below are the steps we are following.
1. Click Team Configuration > Permissions under your project area
2. Click the Process Configuration tab
3. Select a user role from which you want to remove the permission in the Roles list box
4. Click Work Items > Save Work Item (server) > Trigger a workflow action and disable (uncheck) the permission of the desired workflow action
Ideally once the permission is disabled, members under the selected role will not be able to trigger the corresponding workflow action. However this is not working.

We have created a custom WI type and 8 custom roles where 3 workflow stages are to be restricted for all the roles except for 1. however users in all role are able to trigger action without any issue.