Approval and rejection should be a different permission depending upon whether the submission was already approved/rejected.