ERPNext, doctype, workflow, custom script

Greet. I have a new problem. I create a new doctype, then create a workflow. Document status includes Draft->Pending TB->Approved/Rejected. Pending TB will be assigned to two accounts in two different rooms. The problem here is that I want when an employee in department A submits an application, only the person with Pending TB authority and in the corresponding department can approve it. Each account is linked to 1 employee account, so the account department is the employee’s department. However I tried by writing js code in custom.

 before_workflow_action: function(frm) {
        let user = frappe.session.user;
        let phong_ban_cua_don = frm.doc.phong_ban;

        // Lấy thông tin phòng ban của người dùng hiện tại
        frappe.call({
            method: "frappe.client.get",
            args: {
                doctype: "User",
                name: user
            },
            callback: function(r) {
                if (r.message) {
                    let phong_ban_cua_user = r.message.department;

                  
                    if (phong_ban_cua_user !== phong_ban_cua_don) {
                        frappe.msgprint(__('You do not have permission to perform this action.'));
                        frappe.validated = false;
                    }
                }
            }
        });
    }

When actually running, a notification appears. However, the state of the form still moves to the next state exactly like the workflow. I don’t know where is the error? This is the current version:

ERPNext: v15.29.2 (version-15)

Frappe Framework: v15.33.3 (version-15)

Frappe HR: v16.0.0-dev (develop)

How about using

frappe.throw();

instead of

frppe.msgprint();

Is it any different using return? I tried using return but it didn’t work either. Exactly the code will run there, but the workflow will still work normally.

workflow action not trigger validate event.
So, even if you use fappe.validated = false; There is nothing happens.
I think you can either use frappe.throw() or use workflow condition field

doc.phong_ban == frappe.db.get_value("User", frappe.session.user, "department")