Sometimes you want to make a JIRA project read-only, perhaps for archive purposes. It's easy enough to create a permission scheme that gives Browse Projects permission to the same users and removes everyone from the Edit Issues permission. However issues can still change status. That's right, the Edit Issues permission does not stop you from reopening an issue.
The workaround is simple if tedious. Add a condition to every transition in the workflows used by that project. The condition should check that the current user has the Edit Issues permission.
After pondering this for a few minutes, I think that the default JIRA workflow should have this condition on all of its transitions but that's probably not likely to happen. Anyway, I updated http://confluence.atlassian.com/display/JIRA/Archiving+a+Project to make this clearer.