I have discovered an interesting problem with my forms.
After the person submits the form, they get a pop up that says it was submitted and the browser window should close, of course IE then throws up a message that the page is trying to close do you want to? If you press your browsers refresh at either of these messages it reloads the page and you are to the next stage of the form.
Ex: I requested time off. I press submit and then refresh the browser. When the page reloads I am now at the next stage (manager approval). I can then approve/deny this request (as manager). The same will happen for HR approval. So in theory I can approve my request all the way through until it completes.
I have tried various differnt options to combat this, close, close browser, go to new page, but each time the browser refresh problem is there.
Control the state of your objects (the submit button especially) with the stage AND role. Make the submit button hidden or read only for all users except the person who occupies the role that you want submitting a form instance in any given stage.