f0808ac6 (workflow: add workflow transition guard for non-user
actions as well., 2015-11-18) broke some custom security
configurations where doing an action on a document would modify an
accounting transaction - but the user doing this action does not have
access to accounting.

This repairs a little part of the situation (the part we are currently
using in a project), by using the Associate role. The idea is that
for such patterns where users "do something which will interact with
accounting", the users also need an Associate role on accounting
transaction portal types, which is in line with the meaning of
Associate.