There should be a centralised workflow duty with all privileges related to workflow in a single duty instead of spread sporadically through other duties within the security model.

Locating a single privilege or duty relating to workflows within the system is a task that takes time to identify and test.

With a single duty with all privileges related to workflow in a single location would make it so much easier to customise security roles.