Our goal is to have a workflow that works in the following manner-

• A member of the Editors group makes a change to a page and saves it
• The Approvers group is notified via email
• An approver either approves or rejects the change
• If it is approved, the Editors group is notified, and another editor (NOT the one who made the change) will publish the page

To implement this, I've taken the sample workflows on the EPiServer site and integrated them into our solution. Using an adapted version of the sequential approval workflow has got us most of the way there, however we have two outstanding problems-

• The Approvers group would appear to need either Change, Publish or Administer rights in order to look at the approval task generated by the workflow, and to view the unpublished version. Our client wants Approvers to only have read access. If we do that we receive a security error when trying to open the task. Is there any way to provide approvers with access to the task and the unpublished version of the page, whilst still giving them just read access?
• We haven't found a way yet to prevent the editor that made the change from publishing it. After a change is approved another member of the Editors group should do the publish.