If you are using workflow\states for permissions, you know that when you need to add an account or group to a state, it is done using the administrator client. However if someone adds a group or account to a state at the folder level, it will break the inheritance from any changes made via the administrator client. So how do you fix this when it happens.
In PW explorer, on the folder in question, go to the folder properties, folder security, change security type to workflow, change the state to the state where you added the group to the workflow, then remove all the groups\users from the state.
When you click apply, the ‘broken’ permissions will be removed and the correct workflow permissions should be reinstated\re-inherited from what is configured in the administrator client.