Workflow rejects invoices because LE and amount fields can still be edited

Summary

Looking for tips on why these fields can still be edited and what steps are we missing

Content

We are testing new invoice approval workflow rules in our Test environment. Things were going well until we ran into a snag and every invoice is starting to be rejected by the workflow. Looking at the invoices, I see some important fields can still be edited, like Legal Entity and Amount.

I can understand why the workflow would reject invoices in this state, as those fields shouldn't be able to be edited after approval has been given. But we don't understand why the fields are still editable in the first place. AP staff are not doing anything different with these invoices in our Test environment. The invoices have been validated, and accounting has been done on them.