Grant/restrict access according to node's author & moderation state I'm trying to bypass some of the permissions set by Workbench Moderation, only under specific circumstances. For a specific content type, I need the users of a specific Role to be able to:
- View all Published nodes of that content type (this works fine as it is quite general)
- View Unpublished nodes only if the nodes 1. are related to them (through Entity Reference field) or 2. they have created themselves.
- Edit nodes only if they are related to them (through Entity Reference field) or nodes they have created themselves. This should be allowed only in a specific State.

I've tried implementing hook_node_access_records() &amp; hook_node_grants() hooks in my module but this doesn't seem to work. In the following example, the conditionals are different than what's mentioned above but the logic is the same:

function mymodule_node_access_records($node){
    $grants = array();
    if ($node-&gt;nid == 1234 &amp;&amp; $node-&gt;uid == 99) { //(example conditions)
        $grants[] = array(
            'realm' =&gt; 'mymodule',
            'gid' =&gt; 123,
            'grant_view' =&gt; 1,
            'grant_update' =&gt; 0,
            'grant_delete' =&gt; 0,
            'priority' =&gt; 0,
        );
    }
    return $grants;
}

function mymodule_node_grants($account, $op){
    $grants = array();
    if (($op == 'view' || $op == 'update') &amp;&amp; $account-&gt;uid == 99) { //(example conditions)
        $grants['mymodule'] = array(
            123,
        );
    }
    return $grants;
}


This does add a line in node_access table where only grant_view has a value of 1. It should just allow related users to view the specific (unpublished) node but not edit it.

UPDATE: I installed Devel node access and here are my findings for the test case above (node 1234 is Unpublished, user 99 is author):


Test User can View the node - OK
Test User can Edit the unpublished node (non-Published draft) - NOT OK
Test User cannot Delete the node - OK
Test User can Moderate the Unpublished node (allowed transitions set by WM config.) - OK


Here is what Devel actually displays on that node's view page:


Create: YES: by node (permissions) - OK
View: YES: view own unpublished content - OK
Update: YES: by node (permissions) - This should be overridden by my access module
Delete: NO: no reason - OK


How can I override this edit permission with my module? I'd eventually like to expand the functionality of this module to cover other cases as well.
A helper module that I use for managing node access is ACL .


  The ACL module, short for Access Control Lists, is an API for other modules to create lists of users and give them access to nodes. It has no UI of its own and will not do anything by itself


What I suggest is that instead of handling the grants yourself, you outsource it to ACL. The module has a simple (YMMV) to use high-level API that let you grant individual users access (and revoke it).

The documentation is a little sparse, but on the ACL project page existing client projects are listed.  I learnt how to use it by reading the source code of those.

Alternatively, you can read the source code of ACL to see how to do low-level manipulation of permissions.

If you end up writing your own module, the introduction to this page gives a good introduction to how Drupal's node access system works.  In particular, you should be aware of:


  Node access modules always GRANT access and never restrict it. (It is a whitelisting rather than a blacklisting system.) 


I understand you already use DNA (Devel Node Access), but if somebody else stumble across this: DNA (part of the Devel project) is absolutely essential if you are going to debug node access.