revoke access of author to flags I have a workflow system for my nodes, one of the states is "Disable". also there are some flags on those nodes as well, I'd like to know if there's a way to revoke access of author to use flags when he changes the state of workflow to Disable.

Edit: There's a listing of nodes by the logged-in user which is the author, these nodes have different workflow states and different type of flags which each of those flags, does a certain action. In some cases author might wanna change workflow states to different ones, but when he changes the workflow to "Disable", he shouldn't have access to flags on that exact node that has "Disable" state on it.

Changing state to "Disable" revoke access to all flags on that node.
In a rare situation, an admin might change the Workflow state back to something else, which obviously should grant access to the flags for the author, but author himself can't change the state back when he once "disabled" it using workflow.

Example:

Author's list:

Node1 : current workflow state: active, thus accessing to all flags.

Node2 : current workflow state: disable, thus no access to flags.


  Note that Author can change workflow from Active to Disable, not vice
  versa.
  
  Note2: Also I managed to get a rule to flag the node as disabled if
  the node workflow state is set to disabled, so we might be able to
  use flag only relation as well, for instance if disabled flag is
  flagged, deny access to all other flags of the node.


I'm looking for any solution, contrib module or a custom one, or just combination of modules maybe (Rules &amp; flag), whatever that works!

I'm not sure if hook_flag_access() is relevant here or not. 

thanks so much.
hook_flag_access and hook_flag_multiple_access() do seem to be the way to go. You will need to write a small custom module for that, which you can read more from here.

An example implementation is below:

&lt;?php

function MYMODULE_flag_access($flag, $entity_id, $action, $account) {
  if ($flag-&gt;name == 'NAME' &amp;&amp; $flag-&gt;entity_type == 'node') {// Change flag name with your flag's machine name.
    $node = node_load($entity_id);
    if ($node &amp;&amp; $node-&gt;uid == $account-&gt;uid) {
      return FALSE;
    }
  }

  return NULL;
}

function MYMODULE_flag_access_multiple($flag, $entity_ids, $account) {
  if ($flag-&gt;name == 'NAME' &amp;&amp; $flag-&gt;entity_type == 'node') { // Change flag name with your flag's machine name.
    $nodes = node_load_multiple($entity_ids);
    foreach ($nodes as &amp;$node) {
      $node = $node-&gt;uid == $account-&gt;uid ? FALSE : NULL;
    }
    return $nodes;
  }
  return array();
}


You will need to change "MYMODULE" with a module name of your choice, and use the same name and save it as MYMODULE.module. Accompany with the MYMODULE.info, drop in a folder and activate the module. Above is a sample code for you to start with the module. It checks if the Flag's entity type is node. If it's node, the relevant node(s) will be loaded, and the user ID will be matched against the provided account's user ID. If they match, it returns FALSE, indicating access should be denied. It does not explicitly return TRUE, to allow the basic Flag access checks and potential other modules to determine the access.