Looking for a workflow module that can control content access I have a content type called "article".  It needs to go through some workflow states when people try to submit a new article:
submitted -> review 1 -> review 2 -> published.  

During each workflow state, only certain roles should be able to see it, modify it, and comment on it.  This needs to be done independently by its current workflow state.  The workflow module appears to have access control based on states, but then the access control part does not work so essentially everyone can see the content no matter what state it is in.  Not sure if this is a major security bug, permission being overridden by another module, or me doing something wrong.       

Any other suggestions for modules that can do workflow?  I heard Workbench is another good one.  Can it keep track of comments and separate out comments based on workflow states?
Update and solution: Turns out that I was not using the Workflow module correctly and Drupal's permissions correctly. I was assuming that the Workflow module could remove permissions. Instead I had to start with the least privileges in Drupal and then let the Workflow module allow/deny access to the content type. 

For example, if Drupal permissions allow a visitor to see unpublished content, then the Workflow module's content access control will not block the person from seeing unpublished content.