diff --git a/config/alfresco/web-client-config-actions.xml b/config/alfresco/web-client-config-actions.xml
index ee7a29caa6..65890cb62d 100644
--- a/config/alfresco/web-client-config-actions.xml
+++ b/config/alfresco/web-client-config-actions.xml
@@ -308,11 +308,10 @@
             </params>
          </action>
 
-
          <!-- 'Approve' workflow step for document -->
          <action id="approve_doc">
             <permissions>
-               <permission allow="true">WriteProperties</permission>
+               <permission allow="true">Read</permission>
             </permissions>
             <evaluator>org.alfresco.web.action.evaluator.ApproveDocEvaluator</evaluator>
             <label>#{actionContext["app:approveStep"]}</label>
@@ -327,7 +326,7 @@
          <!-- 'Reject' workflow step for document -->
          <action id="reject_doc">
             <permissions>
-               <permission allow="true">WriteProperties</permission>
+               <permission allow="true">Read</permission>
             </permissions>
             <evaluator>org.alfresco.web.action.evaluator.RejectDocEvaluator</evaluator>
             <label>#{actionContext["app:rejectStep"]}</label>
@@ -342,7 +341,7 @@
          <!-- 'Approve' workflow step for document details page -->
          <action id="approve_doc_details">
             <permissions>
-               <permission allow="true">WriteProperties</permission>
+               <permission allow="true">Read</permission>
             </permissions>
             <evaluator>org.alfresco.web.action.evaluator.ApproveDocEvaluator</evaluator>
             <label>#{actionContext.properties["app:approveStep"]}</label>
@@ -357,7 +356,7 @@
          <!-- 'Reject' workflow step for document details page-->
          <action id="reject_doc_details">
             <permissions>
-               <permission allow="true">WriteProperties</permission>
+               <permission allow="true">Read</permission>
             </permissions>
             <evaluator>org.alfresco.web.action.evaluator.RejectDocEvaluator</evaluator>
             <label>#{actionContext.properties["app:rejectStep"]}</label>
@@ -372,7 +371,7 @@
          <!-- 'Approve' workflow step for space -->
          <action id="approve_space">
             <permissions>
-               <permission allow="true">WriteProperties</permission>
+               <permission allow="true">Read</permission>
             </permissions>
             <evaluator>org.alfresco.web.action.evaluator.ApproveDocEvaluator</evaluator>
             <label>#{actionContext["app:approveStep"]}</label>
@@ -387,7 +386,7 @@
          <!-- 'Reject' workflow step for space -->
          <action id="reject_space">
             <permissions>
-               <permission allow="true">WriteProperties</permission>
+               <permission allow="true">Read</permission>
             </permissions>
             <evaluator>org.alfresco.web.action.evaluator.RejectDocEvaluator</evaluator>
             <label>#{actionContext["app:rejectStep"]}</label>
@@ -402,7 +401,7 @@
          <!-- 'Approve' workflow step for space details page -->
          <action id="approve_space_details">
             <permissions>
-               <permission allow="true">WriteProperties</permission>
+               <permission allow="true">Read</permission>
             </permissions>
             <evaluator>org.alfresco.web.action.evaluator.ApproveDocEvaluator</evaluator>
             <label>#{actionContext.properties["app:approveStep"]}</label>
@@ -417,7 +416,7 @@
          <!-- 'Reject' workflow step for space details page-->
          <action id="reject_space_details">
             <permissions>
-               <permission allow="true">WriteProperties</permission>
+               <permission allow="true">Read</permission>
             </permissions>
             <evaluator>org.alfresco.web.action.evaluator.RejectDocEvaluator</evaluator>
             <label>#{actionContext.properties["app:rejectStep"]}</label>
diff --git a/source/java/org/alfresco/web/bean/workflow/WorkflowUtil.java b/source/java/org/alfresco/web/bean/workflow/WorkflowUtil.java
index 270f8fda99..ba5f722143 100644
--- a/source/java/org/alfresco/web/bean/workflow/WorkflowUtil.java
+++ b/source/java/org/alfresco/web/bean/workflow/WorkflowUtil.java
@@ -33,6 +33,8 @@ import java.util.Map;
 import org.alfresco.error.AlfrescoRuntimeException;
 import org.alfresco.model.ApplicationModel;
 import org.alfresco.model.ContentModel;
+import org.alfresco.repo.security.authentication.AuthenticationUtil;
+import org.alfresco.repo.site.SiteServiceException;
 import org.alfresco.service.cmr.repository.AssociationRef;
 import org.alfresco.service.cmr.repository.CopyService;
 import org.alfresco.service.cmr.repository.NodeRef;
@@ -64,7 +66,7 @@ public class WorkflowUtil
     * 
     * @throws AlfrescoRuntimeException
     */
-   public static void approve(NodeRef ref, NodeService nodeService, CopyService copyService)
+   public static void approve(final NodeRef ref, final NodeService nodeService, final CopyService copyService)
       throws AlfrescoRuntimeException
    {
       Node docNode = new Node(ref);
@@ -80,11 +82,11 @@ public class WorkflowUtil
       Boolean approveMove = (Boolean)props.get(ApplicationModel.PROP_APPROVE_MOVE.toString());
       NodeRef approveFolder = (NodeRef)props.get(ApplicationModel.PROP_APPROVE_FOLDER.toString());
       
-      // first we need to take off the simpleworkflow aspect
-      nodeService.removeAspect(ref, ApplicationModel.ASPECT_SIMPLE_WORKFLOW);
-      
       if (approveMove.booleanValue())
       {
+         // first we need to take off the simpleworkflow aspect
+         nodeService.removeAspect(ref, ApplicationModel.ASPECT_SIMPLE_WORKFLOW);
+         
          // move the node to the specified folder
          String qname = QName.createValidLocalName(docNode.getName());
          nodeService.moveNode(ref, approveFolder, ContentModel.ASSOC_CONTAINS,
@@ -92,6 +94,17 @@ public class WorkflowUtil
       }
       else
       {
+         // first we need to take off the simpleworkflow aspect
+         // NOTE: run as system to allow Consumers to copy an item
+         AuthenticationUtil.runAs(new AuthenticationUtil.RunAsWork<Object>()
+         {
+            public String doWork() throws Exception
+            {
+               nodeService.removeAspect(ref, ApplicationModel.ASPECT_SIMPLE_WORKFLOW);
+               return null;
+            }
+         }, AuthenticationUtil.getSystemUserName());
+         
          // copy the node to the specified folder
          String name = docNode.getName();
          String qname = QName.createValidLocalName(name);