/**
 * Implements hook_node_access().
 */
function my_module_node_access(\Drupal\node\NodeInterface $node, $op, \Drupal\Core\Session\AccountInterface $account) {
  $state = $node->moderation_state->value;
  switch($op) {
    case 'update':
      if ($state !== 'draft') {
        if ($account->hasPermission('view any unpublished content')) {
          return AccessResult::allowed()->cachePerPermissions();
        }
        else {
          // Redirect to admin/content
          $url = Url::fromRoute("system.admin_content")->toString();
          $response = new RedirectResponse($url);
          $response->send();
          // Just in case author is trying something evil.
          return AccessResult::forbidden();
        }
      }
      break;
    default :
      return AccessResult::neutral();
      break;
  }
}