Handle permission based on both person and role?
I suggest first to use the Rules module to fire an action on your workflow transition : from 'in moderation' to 'in-review'

Second try to use the Node access user reference module or the Nodeaccess module to use an API method inside your a custom PHP code or as a rule's action to grant the referenced user