I believe you also need Full permissions on the record to which the Workflow is deployed. I've run into this as well