--- a/entities/wfobjs.py	Thu Nov 06 14:35:25 2014 +0100
+++ b/entities/wfobjs.py	Thu Nov 06 18:17:29 2014 +0100
@@ -32,6 +32,16 @@
 from cubicweb.view import EntityAdapter
 from cubicweb.predicates import relation_possible
 
+
+try:
+    from cubicweb import server
+except ImportError:
+    # We need to lookup DEBUG from there,
+    # however a pure dbapi client may not have it.
+    class server(object): pass
+    server.DEBUG = False
+
+
 class WorkflowException(Exception): pass
 
 class Workflow(AnyEntity):
@@ -201,17 +211,30 @@
 
         `eid` is the eid of the object on which we may fire the transition
         """
+        DBG = False
+        if server.DEBUG & server.DBG_SEC:
+            if 'transition' in server._SECURITY_CAPS:
+                DBG = True
         user = self._cw.user
         # check user is at least in one of the required groups if any
         groups = frozenset(g.name for g in self.require_group)
         if groups:
             matches = user.matching_groups(groups)
             if matches:
+                if DBG:
+                    print 'may_be_fired: %r may fire: user matches %s' % (self.name, groups)
                 return matches
             if 'owners' in groups and user.owns(eid):
+                if DBG:
+                    print 'may_be_fired: %r may fire: user is owner' % self.name
                 return True
         # check one of the rql expression conditions matches if any
         if self.condition:
+            if DBG:
+                print ('my_be_fired: %r: %s' %
+                       (self.name, [(rqlexpr.expression,
+                                    rqlexpr.check_expression(self._cw, eid))
+                                   for rqlexpr in self.condition]))
             for rqlexpr in self.condition:
                 if rqlexpr.check_expression(self._cw, eid):
                     return True

--- a/server/__init__.py	Thu Nov 06 14:35:25 2014 +0100
+++ b/server/__init__.py	Thu Nov 06 18:17:29 2014 +0100
@@ -89,7 +89,7 @@
 DBG_ALL  = DBG_RQL + DBG_SQL + DBG_REPO + DBG_MS + DBG_HOOKS + DBG_OPS + DBG_SEC + DBG_MORE
 
 _SECURITY_ITEMS = []
-_SECURITY_CAPS = ['read', 'add', 'update', 'delete']
+_SECURITY_CAPS = ['read', 'add', 'update', 'delete', 'transition']
 
 #: current debug mode
 DEBUG = 0