What is the hook to alter workflow access permissions?
There is no single hook that allows you to control who can see or edit a node in a specific workflow state. You might want to implement hook_node_access_records() to give out grants for a specific node and hook_node_grants() to check whether a specific user has that grant.

The result of your hook_node_access_records() implementation is stored in the database and checked via your hook_node_grants() implementation. Have a look at node_access() to see how the latter is done.

I cannot tell you off-hand what to use as realm and what to use as grant ID. The most important restrictions are:


the grant ID is an integer,
hook_node_access_records() does not know which user tries to access the node,
hook_node_grants() does not know about the node that is being accessed.


In your case, it seems reasonable to put the expected profile value into the "realm" (along with the module name for disambiguation) of your hook_node_access_records() implementation. Your implementation of hook_node_grants() would then check whether the user has that profile value and return the appropriate realms. Still you need to accommodate for the workflow state somewhere.