After additional testing it seems if you set security to not allow editing of incidents, it won't open for edit if there are no more valid workflow steps available, even though it's in a valid workflow step.

This doesn't seem correct.

If I wanted a workflow that enforces a workflow and has an end point (ending workflow step), you should still be able to open it even if it can't change.

Example of Incident workflow:

Open >> Assign >> In Process >> Verify >> Close

You can open all incidents in their workflow except Close.

Is this a defect/bug or by design?