Define/control which users/role(s) can change change to a specific state of work items?
One answer
You can define which Role can trigger which workflow action here:
Project Area - Process Configuration tab - Team Configuration - Permissions (click 'Show all actions and roles') - Work Items - Save Work Item (server) - Trigger a workflow action ... click only those Roles which you want able to e.g. Close a Defect.
(not sure you can further define this at specific user level)