It is about the workflow step permissions. See the documentation on this topic. Or, if the user is in a role with "Manage workflow" permission (Content module), then the users in this role are "workflow admins" and can manage any workflow in the site and manage any step of the workflow.