Roles vs Workflow for manual update record issue

Question

I am sorry for taking your time but I need some HELP as we go life with MDM and there is still one open topic that is connected to workflow implementation. 
Do you have maybe someone who can advice me a solution or workaround to solve this issue. See description below.
We are using role based workflow (few of workflows triggered one by one depends on the task that needs to be performed)
As agreed with our client the several users are not allowed to:
Modify (add/remove) original records
Start workflows
Check out / roll back records 
Our solution provides them with option to do any kind off modification on Check Out records, and that action is triggered as automatic result of import records.
NOW a small issue appeared since the import from MDP is made based on a new rapport that does not have several fields that we where using to determinate what items from materials will change. 
So the next idea was to do that manually since it happens only few times a year for more or less 10 items. And that is where the problems started.
I want to have a small workflow that will do as follows:
Check Out Record -> Allowed to make changes -> Send to the next step (Approval process will be started)
but we do not want to allow them do Checkout record or add to job
(It can be only acceptable if we can allow them to add to ONE of the workflows but not all of them)
I tried also to use the trigger actions Record Update2 but Workflow checkout occurs after record update (update applied to original record) so that is not applicable to, as since we want to keep original data in case someone rejects the new changes (that way we can always go back to original records). I would rather need something like Record Import only without the import part (it checks out the record and only then it allows to do any changes). ;P
If the description is not clear let me know I will try to “translate it to easier English”
Hope to hear from someone soon 
Aleksandra

Answer 1

From reading your question, I gather the following:
You would like for users to be able to edit a record, which will automatically trigger a workflow, and if it's rejected then it should roll back the changes.  However, the user should not be able to manually start the workflow, it must be started and launched automatically on record edit.  Does that sound correct?
If so, then you may have an issue.  While an edit can be used to launch a workflow, the workflow is not geared towards approving that edit.  It's assumed that other changes will be made, and those changes are the ones that will be approved or rejected.  This seems a bit strange I know, and hopefully this issue will be addressed in future versions.  However, I think you're only alternative is to have the users be able to start their own workflows.  You can probably use a security role such that a user can't modify normal records, but can only modify records that are checked out to them.  Then you would have to modify your workflow such that it only contains one record at a time, this way the user would not be able to add multiple records to the workflow.
Does that make sense?  I hope this helps.