You can know from the name if it is for state field or not. For example, for below it is sysapproval_approver.state.

ACL is at dictionary as well as form level. That's the idle way of restricting users from editing a field, which adds more security.

When you open the dictionary record of state field, you should see the ACL.