For consistency purpose and ease of understanding, it would be nice to hide action menu which should not be available to the current role/user. In the current scenario, I created a new "Validator" role which can only get access to the first step of a complex workflow. He is not capable of launching a new workflow nor to publish a 1 step or a 2 step workflow.

However I still see the action menu in the toolbar to initiate some workflow (or to unpublish pages). If I try to publish the whole site, I can even publish with a one step workflow (normally this user has not right on this given workflow) the file page

P.S: Put the role in attachment if required