I have a content type called "article". It needs to go through some workflow states when people try to submit a new article: submitted -> review 1 -> review 2 -> published.
During each workflow state, only certain roles should be able to see it, modify it, and comment on it. This needs to be done independently by its current workflow state. The workflow module appears to have access control based on states, but then the access control part does not work so essentially everyone can see the content no matter what state it is in. Not sure if this is a major security bug, permission being overridden by another module, or me doing something wrong.
Any other suggestions for modules that can do workflow? I heard Workbench is another good one. Can it keep track of comments and separate out comments based on workflow states?