Web Page Access Control Rules can be linked with publishing states to allow or deny the right to view or modify content based on the branch of the website and the publishing state of content within that branch.

When creating a Web Page Access Control Rule, Associate that rule with a publishing state:

Once it is associated with a publishing state, the rule will only be applied to web pages when that publishing state is active.

For example, say you wanted someone in the content publishing role to be able to modify a page’s content, but only when that page is in Draft mode.  This would ensure that changes to the page are not done while the page is ‘live’ and would allow for an approval process to be undertaken on pending changes.

To do this, you would create a rule with the grant change permission and apply it to the branch in question (or the home page if the rule is to apply to the entire site).  You would then associate this rule with the draft state.

You would then associate this rule with the Content publishing web role.  Assuming this webrole is not associated with a more permissive rule (i.e. a rule that grants change regardless of publishing state) then users in the content publishing web role will be able to modify pages in the draft state but will not be able to modify pages in the published state.