Grant/restrict access according to node's author & moderation state
A helper module that I use for managing node access is ACL .


  The ACL module, short for Access Control Lists, is an API for other modules to create lists of users and give them access to nodes. It has no UI of its own and will not do anything by itself


What I suggest is that instead of handling the grants yourself, you outsource it to ACL. The module has a simple (YMMV) to use high-level API that let you grant individual users access (and revoke it).

The documentation is a little sparse, but on the ACL project page existing client projects are listed.  I learnt how to use it by reading the source code of those.

Alternatively, you can read the source code of ACL to see how to do low-level manipulation of permissions.

If you end up writing your own module, the introduction to this page gives a good introduction to how Drupal's node access system works.  In particular, you should be aware of:


  Node access modules always GRANT access and never restrict it. (It is a whitelisting rather than a blacklisting system.) 


I understand you already use DNA (Devel Node Access), but if somebody else stumble across this: DNA (part of the Devel project) is absolutely essential if you are going to debug node access.