You need to look at your relationship between groups/roles and permissions for your workflow. I would look at if view only or edit issues permissions and see where they are specified.
For example, if you have a group called jira-users if it does not have edit issues then you cannot edit issues. Since you moved everything over to on hold, I would start with there.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.